oauth2 2.0.26 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 362550ce65f2632c09c067acada7e36f37314e59a016257742019e7c4bd8adc2
-  data.tar.gz: e6f9cef5e5980840d428f0a577255555371ab151e66a78dceb1ea9b7a168fa9b
+  metadata.gz: 6c9c55fc9440e00e86933108643637ca90a94eee13cb15c681f410d32184338b
+  data.tar.gz: 83f047fee37e950e07b1818bf0e427c22d39dc5ec27a4e2d70e4df8ddbcab6af
 SHA512:
-  metadata.gz: 309b6d12823319c793c211328e78b50da808807aecf7ee27049e2cdc36e252ec63267c8635d61be1015b58b95cea821680bcc65ee65e589a784e1a598561ee7e
-  data.tar.gz: 99d0e680e42243e6f35692826a27ce93f7fd3cc2372b65df4318d6bcef795ad7c9af707c04509fcede27317308d7c9f07272ebe61de1e7eedef44ba69b1d28a8
+  metadata.gz: 399c3d96bb47d79e0bcb57c2213226680721adf659280a87848f2424c2c8ed3a04865aeae2d73ec88a4fd768f0699b0e226d0530d0c652257a172e9a2c66b91b
+  data.tar.gz: 123aa2d9c1bc3e559d7c4068e157e1aa40e07e94f861786071b0ca0e17f732c07e7391f3e2fb2db63582fa75718897b36b8b64db95626d2e04976bff68853c1e

data/CHANGELOG.md

@@ -30,13 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
-## [2.0.26] - 2026-10-25
+## [2.1.0] - 2026-10-25
 
-- TAG: [v2.0.26][2.0.26t]
-- COVERAGE: 98.48% -- 647/657 lines in 16 files
-- BRANCH COVERAGE: 93.48% -- 215/230 branches in 16 files
+- TAG: [v2.1.0][2.1.0t]
+- COVERAGE: 98.48% -- 649/659 lines in 16 files
+- BRANCH COVERAGE: 93.53% -- 217/232 branches in 16 files
 - 90.83% documented
 
+### Changed
+
+- **BREAKING**: `allow_cross_origin_redirects` now defaults to `false`. Cross-origin redirects are blocked before credentials are replayed. Set `allow_cross_origin_redirects: true` explicitly to retain the previous behavior (deprecated).
+
 ### Security
 
 - GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see [gh!769][gh!769]. Reported by iamibi.
@@ -44,13 +48,23 @@ Please file a bug if you notice a violation of semantic versioning.
 - [gh!769][gh!769] - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require `auth-sanitizer` >= 0.2.5 by @makssein
 - [gh!775][gh!775] - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @Huge
 - [gh!776][gh!776] - Redact configured sensitive response options from tokenless access-token initialization errors by @Huge
-- GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see [gh!769][gh!769]. Reported by iamibi.
 
 [gh!769]: https://github.com/ruby-oauth/oauth2/pull/769
 [gh!770]: https://github.com/ruby-oauth/oauth2/pull/770
 [gh!775]: https://github.com/ruby-oauth/oauth2/pull/775
 [gh!776]: https://github.com/ruby-oauth/oauth2/pull/776
 
+## [2.0.26] - 2026-10-25
+
+- TAG: [v2.0.26][2.0.26t]
+- COVERAGE: 98.48% -- 647/657 lines in 16 files
+- BRANCH COVERAGE: 93.48% -- 215/230 branches in 16 files
+- 90.83% documented
+
+### Security
+
+- GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see [gh!769][gh!769]. Reported by iamibi.
+
 ### Deprecated
 
 - `allow_cross_origin_redirects: true` is deprecated. The default will change to `false` in the next minor release (2.1.0). Set it explicitly to retain the current behavior.
@@ -1048,7 +1062,9 @@ Please file a bug if you notice a violation of semantic versioning.
 
 [gemfiles/readme]: gemfiles/README.md
 
-[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.26...HEAD
+[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.1.0...HEAD
+[2.1.0]: https://github.com/ruby-oauth/oauth2/compare/v2.0.26...v2.1.0
+[2.1.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.1.0
 [2.0.26]: https://github.com/ruby-oauth/oauth2/compare/v2.0.25...v2.0.26
 [2.0.26t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.26
 [2.0.25]: https://github.com/ruby-oauth/oauth2/compare/v2.0.24...v2.0.25

data/README.md

@@ -1084,7 +1084,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.657-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.659-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/ruby-oauth/oauth2/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/oauth2/client.rb

@@ -66,6 +66,9 @@ module OAuth2
         raise_errors: true,
         logger: ::Logger.new($stdout),
         access_token_class: AccessToken,
+        # Default changed from true to false in 2.1.0 for security.
+        # Cross-origin redirects are now rejected before credentials are replayed.
+        allow_cross_origin_redirects: false,
       }.merge(opts)
       @options[:connection_opts][:ssl] = ssl if ssl
     end
@@ -491,6 +494,14 @@ module OAuth2
     def sanitize_redirect_options(req_opts, current_location, next_location)
       return req_opts unless cross_origin_redirect?(current_location, next_location)
 
+      unless options[:allow_cross_origin_redirects]
+        raise OAuth2::Error.new(
+          "error" => "cross_origin_redirect_blocked",
+          "error_description" => "Cross-origin redirect blocked: #{current_location.scheme}://#{current_location.host} -> #{next_location.scheme}://#{next_location.host}. " \
+            "Set allow_cross_origin_redirects: true to allow (deprecated)."
+        )
+      end
+
       safe_opts = req_opts.dup
 
       [:headers, "headers"].each do |key|

data/lib/oauth2/version.rb

@@ -4,7 +4,7 @@ module OAuth2
   # Version namespace for this gem.
   module Version
     # Current gem version.
-    VERSION = "2.0.26"
+    VERSION = "2.1.0"
   end
   # Current gem version exposed at the traditional constant location.
   VERSION = Version::VERSION # Traditional Constant Location

data.tar.gz.sig

@@ -1,2 +1,2 @@
-�e��+4%zNM� ]�Y��U6�l�6�Yu�o��ӀTt*��.b��-��fq@��2�}F�Q�8UF�Ws�'��ݴ���Q�W����
-T��d
+�^�=�Z��ȩ�X�+W���]�
+x��a"<$

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oauth2
 version: !ruby/object:Gem::Version
-  version: 2.0.26
+  version: 2.1.0
 platform: ruby
 authors:
 - Erik Michaels-Ober
@@ -593,10 +593,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://oauth2.galtzo.com
-  source_code_uri: https://github.com/ruby-oauth/oauth2/tree/v2.0.26
-  changelog_uri: https://github.com/ruby-oauth/oauth2/blob/v2.0.26/CHANGELOG.md
+  source_code_uri: https://github.com/ruby-oauth/oauth2/tree/v2.1.0
+  changelog_uri: https://github.com/ruby-oauth/oauth2/blob/v2.1.0/CHANGELOG.md
   bug_tracker_uri: https://github.com/ruby-oauth/oauth2/issues
-  documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.26
+  documentation_uri: https://www.rubydoc.info/gems/oauth2/2.1.0
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/ruby-oauth/oauth2/wiki
   news_uri: https://www.railsbling.com/tags/oauth2