diff options
| author | Leitwolf11 | 2026-10-23 11:13:27 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-10-23 11:13:27 +0300 |
| commit | 06dfa204e4a65c535eb9b3d775a77b5d14522060 (patch) | |
| tree | ce178c734f82acf467e1d9052c13ee54b323c164 /apps/web | |
| parent | 9099e9fbb50d27b622362b0c2f0dda5085d1fa03 (diff) | |
| download | progmaweb-feature/oauth-application-types.tar.gz | |
Withdraw an allowance only from the account's own authorizationsfeature/oauth-application-types
CodeQL flagged the withdraw endpoint: the authorization was looked up by
the identifier in the address and then checked against the account. The
endpoint now searches only the signed-in account's authorizations for that
identifier and revokes the tokens by the identifier it found, so another
account's allowance is never loaded. A test withdraws as another account
and gets 404.
Diffstat (limited to 'apps/web')
0 files changed, 0 insertions, 0 deletions