herel afcd230c3a fix(api): Send PKCE code_verifier in token exchange and secure OIDC cookies ...

The /exchange-token endpoint was not sending the code_verifier to the
token endpoint, rendering PKCE protection ineffective. Add the verifier
to the POST body so the IdP can validate the authorization code exchange.

Also add secure=True and samesite='Lax' to all OIDC cookies on /login
to improve cookie security per the recommended remediation.

Refs vuln-0004

2026-06-29 19:49:07 +02:00

..

__init__.py

initial import

2024-11-01 09:59:45 +01:00

myice.py

fix: add timeout for request

2026-06-29 16:52:35 +02:00

webapi.py

fix(api): Send PKCE code_verifier in token exchange and secure OIDC cookies

2026-06-29 19:49:07 +02:00