fix(security): harden OAuth login, server-side SSRF, audit logging, and agent token by ZingerLittleBee · Pull Request #133 · ZingerLittleBee/ServerBee

docs: add OAuth login CSRF / session fixation fix design

ZingerLittleBee

committed

docs: add OAuth login CSRF fix implementation plan

ZingerLittleBee

committed

fix(server): bind OAuth login state to initiating browser via pre-auth cookie

ZingerLittleBee

committed

feat(server): adopt PKCE (S256) in OAuth login flow

ZingerLittleBee

committed

fix(server): redact OAuth flow secrets in Debug and assert PKCE verifier round-trip

ZingerLittleBee

committed

docs(server): clarify PKCE verifier comment in OAuth callback

ZingerLittleBee

committed

fix(server): audit-log DB backup/restore and user management actions

ZingerLittleBee

committed

fix(server): prefer Authorization header over query string for agent WS token

ZingerLittleBee

committed

fix: SSRF-guard service-monitor checkers via shared common guard

ZingerLittleBee

committed

fix(server): allow custom ports in HTTP keyword monitor checks

ZingerLittleBee

committed

fix(server): persist restore audit log into the restored database

ZingerLittleBee

committed

fix(server): re-validate SSRF guard on each HTTP keyword redirect hop

ZingerLittleBee

committed

fix(server): reject loopback/metadata monitor targets at create time

ZingerLittleBee

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): harden OAuth login, server-side SSRF, audit logging, and agent token#133

fix(security): harden OAuth login, server-side SSRF, audit logging, and agent token#133
ZingerLittleBee merged 13 commits into
mainfrom
secuity

Commits on Jun 8, 2026

docs: add OAuth login CSRF / session fixation fix design

docs: add OAuth login CSRF fix implementation plan

fix(server): bind OAuth login state to initiating browser via pre-auth cookie

feat(server): adopt PKCE (S256) in OAuth login flow

fix(server): redact OAuth flow secrets in Debug and assert PKCE verifier round-trip

docs(server): clarify PKCE verifier comment in OAuth callback

fix(server): audit-log DB backup/restore and user management actions

fix(server): prefer Authorization header over query string for agent WS token

fix: SSRF-guard service-monitor checkers via shared common guard

fix(server): allow custom ports in HTTP keyword monitor checks

fix(server): persist restore audit log into the restored database

fix(server): re-validate SSRF guard on each HTTP keyword redirect hop

fix(server): reject loopback/metadata monitor targets at create time