Repository navigation

Security lows: credentials stay on their origin across redirects; MCP loopback Host/Origin checks, --auth-token-file (2.13.18) - #82

Merged

wardviaene merged 2 commits into

mainfrom

Nov 14, 2026

Merged

Security lows: credentials stay on their origin across redirects; MCP loopback Host/Origin checks, --auth-token-file (2.13.18)#82
wardviaene merged 2 commits into
mainfrom
redirect-auth

Commits on Nov 14, 2026
- Security: credentials stay on their origin across redirects (SDK); loopback Host/Origin checks and --auth-token-file (MCP) - 2.13.18
  
  wardviaene
  and
  claude
  committed
  9fdca20
- MCP login refresh also keeps its token on its origin; a test's fake urlopen still applies
  
  wardviaene
  and
  claude
  committed
  32ee807