openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-13 11:47:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restrict login setup redirects to known platform origins (#44670)

Browse Source 
## Why

The login success pages use `platform_url` from the query string to build an organization setup redirect that includes the ID token. An arbitrary destination could receive that token.

## What changed

Require `platform_url` to exactly match `https://platform.openai.com` or `https://platform.api.openai.org` before showing the setup prompt or starting the redirect countdown. Apply the check to both the current and legacy login success pages.

GitOrigin-RevId: 37a08482c23b82483fd519f943a0b4eb6caaa161
This commit is contained in:
Drew Hintz
2026-09-10 23:06:32 +00:00
committed by copyberry
parent cc05ecfe17
commit 1b83e5cdf9
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
codex-rs/login/src/assets/success.html
View File

@@ -209,6 +209,13 @@
}
if (needsSetup) {
// The login server selects one of these platform origins from the OAuth issuer.
if (
platformUrl !== "https://platform.openai.com" &&
platformUrl !== "https://platform.api.openai.org"
) {
return;
}
const setupBox = document.getElementById("setup-box");
const countdownNode = document.getElementById("countdown");
setupBox.style.display = "block";

7
codex-rs/login/src/assets/success_legacy.html
View File

@@ -166,6 +166,13 @@
const idToken = params.get('id_token');
// Show different message and optional redirect when setup is required
if (needsSetup) {
// The login server selects one of these platform origins from the OAuth issuer.
if (
platformUrl !== 'https://platform.openai.com' &&
platformUrl !== 'https://platform.api.openai.org'
) {
return;
}
const setupBox = document.querySelector('.setup-box');
setupBox.style.display = 'flex';
const redirectUrlObj = new URL('/org-setup', platformUrl);