Chris Farhood
1f6fd7acfe
Unauthenticated DCR previously accepted any redirect_uri; combined with the auto-approving /consent handler an attacker could register a client pointing at their domain, phish a logged-in user, and silently receive an auth code for the victim's identity. Reject non-allowlisted redirect_uri hosts at registration (default: claude.ai, claude.com, and the BETTER_AUTH_URL/portal host). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
39 lines
1.5 KiB
Bash
39 lines
1.5 KiB
Bash
# intervalsicu-mcp-auth — environment (copy to .env; do not commit real secrets)
|
|
|
|
# Public base URL of this auth server. The OAuth/OIDC issuer is <this>/api/auth.
|
|
BETTER_AUTH_URL=https://intervalsicu.farhoodlabs.com
|
|
# Better Auth signing secret — generate a long random string.
|
|
BETTER_AUTH_SECRET=
|
|
# Postgres connection string (the shared CNPG database).
|
|
AUTH_DATABASE_URL=postgres://user:password@host:5432/dbname
|
|
|
|
# Google social login credentials.
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# Optional Apple sign-in (added only if all three are set).
|
|
# APPLE_CLIENT_ID=
|
|
# APPLE_CLIENT_SECRET=
|
|
# APPLE_APP_BUNDLE_IDENTIFIER=
|
|
|
|
# Comma-separated allowed token audiences / RFC 8707 resources — must include the
|
|
# MCP server's /mcp URL so issued access tokens carry the right aud.
|
|
VALID_AUDIENCES=https://intervalsicu.farhoodlabs.com/mcp
|
|
# Comma-separated trusted origins for Better Auth.
|
|
TRUSTED_ORIGINS=https://intervalsicu.farhoodlabs.com
|
|
|
|
# Comma-separated hostnames allowed as DCR client redirect_uri hosts. When unset,
|
|
# defaults to claude.ai, claude.com and the BETTER_AUTH_URL host (the portal).
|
|
# This is a security control: it blocks attacker-registered clients from pointing
|
|
# authorization codes at their own domain. Set only to override the defaults.
|
|
# ALLOWED_REDIRECT_HOSTS=claude.ai,claude.com,intervalsicu.farhoodlabs.com
|
|
|
|
# Logger level: debug | info (default info).
|
|
LOG_LEVEL=info
|
|
# HTTP listen port (default 8080).
|
|
PORT=8080
|
|
|
|
# Portal OIDC client seeded by migrate.ts (both have defaults; override if needed).
|
|
# PORTAL_CLIENT_ID=
|
|
# PORTAL_REDIRECT_URI=
|