hearth-dash 1.1.3 → 1.1.4

package/README.md

@@ -126,6 +126,10 @@ Version 1.1.2 accepts Chrome's legitimate `Origin: null` on a form submission on
 
 Version 1.1.3 replaces the OAuth consent page's double-submit CSRF cookie with a short-lived, one-time D1 token bound to the complete authorization request and consumed atomically. This avoids browser cookie-context failures during Railway/Claude handoff without weakening same-origin checks or replay protection.
 
+### 1.1.4 OAuth callback CSP fix
+
+Version 1.1.4 gives each authorization page a narrow `form-action` policy containing only Hearth itself and that request's already validated HTTP(S) OAuth callback origin. This allows the browser to follow the successful POST redirect without permitting arbitrary form destinations.
+
 ## Security notes
 
 - There are no functional default credentials, bearer tokens or secret-bearing connector URLs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hearth-dash",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Personal dashboard — moods, moments, food diary, weather, and more. Deploy to Cloudflare in one command.",
   "type": "module",
   "bin": {

package/worker.js

@@ -68,9 +68,11 @@ async function verifySession(token, secret) {
   }
 }
 
+const CSP_BASE = "default-src 'self'; img-src 'self' data: https://openweathermap.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'";
+
 function securityHeaders(extra = {}) {
   return {
-    'Content-Security-Policy': "default-src 'self'; img-src 'self' data: https://openweathermap.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+    'Content-Security-Policy': `${CSP_BASE}; form-action 'self'`,
     'Referrer-Policy': 'no-referrer',
     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
     'X-Content-Type-Options': 'nosniff',
@@ -80,6 +82,21 @@ function securityHeaders(extra = {}) {
   };
 }
 
+function oauthCallbackCspSource(redirectUri) {
+  const redirect = new URL(redirectUri);
+  if (!['http:', 'https:'].includes(redirect.protocol) || redirect.origin === 'null') {
+    throw new Error('Unsupported OAuth redirect URI scheme');
+  }
+  return redirect.origin;
+}
+
+function oauthConsentHeaders(callbackSource, extra = {}) {
+  return securityHeaders({
+    ...extra,
+    'Content-Security-Policy': `${CSP_BASE}; form-action 'self' ${callbackSource}`,
+  });
+}
+
 function sessionCookie(value, maxAge = 604800) {
   return `__Host-hearth_session=${value}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=${maxAge}`;
 }
@@ -747,7 +764,7 @@ async function consumeOAuthCsrf(env, oauthRequest, token) {
 function validAuthorizationParameterMultiplicity(url) {
   const singleton = [
     'response_type', 'client_id', 'redirect_uri', 'scope', 'state',
-    'code_challenge', 'code_challenge_method',
+    'code_challenge', 'code_challenge_method', 'resource',
   ];
   return singleton.every(name => url.searchParams.getAll(name).length <= 1);
 }
@@ -805,6 +822,12 @@ export const oauthDefaultHandler = {
     }
     const client = await env.OAUTH_PROVIDER.lookupClient(oauthRequest.clientId);
     if (!client) return new Response('Unknown OAuth client', { status: 400, headers: securityHeaders() });
+    let callbackCspSource;
+    try {
+      callbackCspSource = oauthCallbackCspSource(oauthRequest.redirectUri);
+    } catch {
+      return new Response('Unsupported OAuth callback scheme', { status: 400, headers: securityHeaders({ 'Cache-Control': 'no-store' }) });
+    }
 
     const sessionToken = getCookie(request, '__Host-hearth_session');
     const signedIn = await verifySession(sessionToken, config.SESSION_SECRET);
@@ -819,7 +842,7 @@ export const oauthDefaultHandler = {
       } catch {
         return csrfStorageUnavailable();
       }
-      const headers = new Headers(securityHeaders({ 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }));
+      const headers = new Headers(oauthConsentHeaders(callbackCspSource, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }));
       return new Response(renderOAuthConsentPage(request.url, oauthRequest, client, csrf, signedIn), { headers });
     }
 
@@ -861,7 +884,7 @@ export const oauthDefaultHandler = {
       } catch {
         return csrfStorageUnavailable();
       }
-      const headers = new Headers(securityHeaders({ 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }));
+      const headers = new Headers(oauthConsentHeaders(callbackCspSource, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }));
       return new Response(renderOAuthConsentPage(request.url, oauthRequest, client, csrf, false, 'Wrong dashboard password'), { status: 401, headers });
     }