mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
## What changed - Cover same-origin redirects for protected-resource and authorization-server metadata. - Verify that cross-origin redirects are rejected before contacting their targets and that redirect cycles fail within a bounded timeout. - Exercise issuer validation and resource-header isolation for both direct and redirected metadata across legacy and Agent Plugin discovery modes. - Reuse the test environment's local HTTP client throughout the discovery tests. GitOrigin-RevId: bd12ac232c3b020a1c098a413361f8e205699699