Routing patch for google - #183
Merged
Merged
Conversation
This reverts the route changes from the previous commit to fix Google OAuth redirect_uri_mismatch error. The /auth → /oauth change was unnecessary and caused breaking changes: - Google OAuth Console has redirect_uri registered as /oauth/google/callback - Changing to /auth/google/callback caused redirect_uri_mismatch errors - Route conflict with /oauth/* catch-all was not actually an issue The real fix for Blazer OAuth flow is in authentication.ex's login_redirect function, which now detects OAuth Provider flow and preserves it instead of redirecting to REDIRECT_URL. Changes: - Revert base_path from "/auth" to "/oauth" in Ueberauth config - Revert routes from /auth/:provider to /oauth/:provider Fixes: Google OAuth login redirect_uri_mismatch error
PROBLEM: October 29 security patch (e75abcb) added catch-all route but accidentally reordered OAuth routes. October 30 fix (56e0d80) moved catch-all to end but left routes in wrong order, causing intermittent failures. ROOT CAUSE: Phoenix matches routes top-to-bottom. When /oauth/:provider comes before /oauth/authorize, requests to /oauth/authorize match the pattern route with provider='authorize', routing to UserOAuthController instead of AuthorizeController. SYMPTOMS: - 'OAuth request could not be processed' error - Blazer OAuth fails when user not logged in - Works intermittently when user already authenticated (skips authorize flow) - GitHub/Google login always works (uses /oauth/github, /oauth/google) SOLUTION: Restore original route order from before October 29 while keeping catch-all: 1. /oauth/authorize (specific - OAuth Provider for Blazer etc) 2. /oauth/:provider (pattern - user GitHub/Google login) 3. /oauth/*path (catch-all - security feature from October 29) VERIFICATION: - Matches pre-patch working configuration - All 103 tests pass - Route order confirmed with mix phx.routes This fix is permanent - based on fundamental Phoenix routing rules.
erinxocon
added a commit
that referenced
this pull request
Sep 15, 2026
* Secure patch (#175) - Fix OAuth 404 error handling - Limit 10-30 times request per IP address - Inprove routing match sequence * Use client_id in OAuth token rate limiting (#176) * Fix OAuth 404 error handling * Limit 10-30 times request per IP address Inprove routing match sequence * Use client_id in OAuth token rate limiting - Rate limit by IP+client_id instead of IP only - Gives each OAuth app independent 100/min quota - Prevents cross-service rate limit interference * Fix router issue (#177) * Fix OAuth 404 error handling * Limit 10-30 times request per IP address Inprove routing match sequence * Use client_id in OAuth token rate limiting - Rate limit by IP+client_id instead of IP only - Gives each OAuth app independent 100/min quota - Prevents cross-service rate limit interference * Fix OAuth callback blocking by catch-all route Critical fix: Move catch-all route to END of router - /oauth/:provider/callback was being blocked - Customers couldn't log in via GitHub/Google OAuth - Catch-all must come AFTER all legitimate routes Fixes: GitHub OAuth login returning 404 error * Fix oauth security minimal (#178) * Add rate limiting and security to OAuth endpoints - Add rate limiting to all OAuth endpoints to prevent abuse - Token endpoint: 100/min per IP+client_id (independent quotas per OAuth client) - Authorize endpoint: 50/min per IP - User OAuth (GitHub/Google): 20/min per IP - Invalid paths: 10/min per IP - Add catch-all route for scanning attacks (/oauth/.env, etc.) - Support X-Forwarded-For for load balancers Fixes Datadog errors from endpoint scanning attacks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Revert "Login sync bc (#174)" This reverts commit 0970060. * Revert "Update Oauth account can't recevice password changing email (#173)" This reverts commit 3b7cd90. * Revert "Redirect 405 error (#172)" This reverts commit b16b416. * Revert "Fix BigCommerce integration to prevent incomplete account creation (#171)" This reverts commit d37bde6. * Revert "Update email login cases - only 422 email exist case can success now (#170)" This reverts commit f836a1e. * Revert "Fix deploy issue (#169)" This reverts commit 1c25838. * Revert "Add rate limiting and security to OAuth endpoints" This reverts commit 0a65c21. --------- Co-authored-by: Claude <noreply@anthropic.com> * Add releases configuration for ECS deployment (#179) * Plug.Conn.NotSentError (#180) * Plug.Conn.NotSentError * Plug.Conn.NotSentError * Plug.conn.not sent error (#181) * Plug.Conn.NotSentError * Plug.Conn.NotSentError * Fix OAuth routing conflict by separating user auth from OAuth provider * Fix OAuth routing conflict by separating user auth from OAuth provider * Revert OAuth user login routes from /auth back to /oauth (#182) This reverts the route changes from the previous commit to fix Google OAuth redirect_uri_mismatch error. The /auth → /oauth change was unnecessary and caused breaking changes: - Google OAuth Console has redirect_uri registered as /oauth/google/callback - Changing to /auth/google/callback caused redirect_uri_mismatch errors - Route conflict with /oauth/* catch-all was not actually an issue The real fix for Blazer OAuth flow is in authentication.ex's login_redirect function, which now detects OAuth Provider flow and preserves it instead of redirecting to REDIRECT_URL. Changes: - Revert base_path from "/auth" to "/oauth" in Ueberauth config - Revert routes from /auth/:provider to /oauth/:provider Fixes: Google OAuth login redirect_uri_mismatch error * Routing patch for google (#183) * Revert OAuth user login routes from /auth back to /oauth This reverts the route changes from the previous commit to fix Google OAuth redirect_uri_mismatch error. The /auth → /oauth change was unnecessary and caused breaking changes: - Google OAuth Console has redirect_uri registered as /oauth/google/callback - Changing to /auth/google/callback caused redirect_uri_mismatch errors - Route conflict with /oauth/* catch-all was not actually an issue The real fix for Blazer OAuth flow is in authentication.ex's login_redirect function, which now detects OAuth Provider flow and preserves it instead of redirecting to REDIRECT_URL. Changes: - Revert base_path from "/auth" to "/oauth" in Ueberauth config - Revert routes from /auth/:provider to /oauth/:provider Fixes: Google OAuth login redirect_uri_mismatch error * Fix OAuth routing: restore correct order from before October 29 patch PROBLEM: October 29 security patch (e75abcb) added catch-all route but accidentally reordered OAuth routes. October 30 fix (56e0d80) moved catch-all to end but left routes in wrong order, causing intermittent failures. ROOT CAUSE: Phoenix matches routes top-to-bottom. When /oauth/:provider comes before /oauth/authorize, requests to /oauth/authorize match the pattern route with provider='authorize', routing to UserOAuthController instead of AuthorizeController. SYMPTOMS: - 'OAuth request could not be processed' error - Blazer OAuth fails when user not logged in - Works intermittently when user already authenticated (skips authorize flow) - GitHub/Google login always works (uses /oauth/github, /oauth/google) SOLUTION: Restore original route order from before October 29 while keeping catch-all: 1. /oauth/authorize (specific - OAuth Provider for Blazer etc) 2. /oauth/:provider (pattern - user GitHub/Google login) 3. /oauth/*path (catch-all - security feature from October 29) VERIFICATION: - Matches pre-patch working configuration - All 103 tests pass - Route order confirmed with mix phx.routes This fix is permanent - based on fundamental Phoenix routing rules. * Bump toolchain to Elixir 1.18.5-otp-27 Bumps CI images, Dockerfile, and .tool-versions from Elixir 1.14.3-otp-25/Erlang 25.3.2.16 to 1.18.5-otp-27/Erlang 27.3.4.17, and fixes what the bump itself surfaced with no dependency changes: - Logger.warn/1 -> Logger.warning/2 (deprecated since Elixir 1.15) at 4 call sites, plus config :logger, level: :warn -> :warning - two unreachable clauses removed (fallback_controller.ex, user_settings_two_factor_controller.ex), surfaced by Elixir 1.18's new type checker; both provably dead, not called anywhere * Fix critical grpc RCE Pins bottle to system76/bottle@229a577b, which bumps grpc 0.5.0 (< 1.0.0) to ~> 1.0 to fix a critical RCE (GHSA-grp7-v8xh-rj7h / CVE-2026-48853) and moves to amqp ~> 4.0 so rabbit_common resolves cleanly on OTP 27 with no version overrides. grpc ~> 1.0 requires protobuf ~> 0.17, which removed the deprecated Message.new/1 helper every generated struct used to get for free (protobuf's own CHANGELOG: deprecated in v0.15.0, removed in v0.17.0). Recognizer's two call sites switch to struct!/2, matching bottle's own fix for the same break: lib/recognizer/caster.ex and lib/recognizer/notifications/account.ex (the latter used apply(type, :new, [...]) for dynamic dispatch, easy to miss grepping for a literal ".new("). Also bumps spandex ~> 3.2 / spandex_datadog ~> 1.4.0: the old versions capped telemetry at ~> 0.4, incompatible with grpc_core's telemetry ~> 1.0 requirement pulled in by this same bottle bump. * Swap logger_json to the maintained Hex package Nebo15/logger_json@8e4290a was pinned to a 2021 git fork (reasonable at the time -- Hex hadn't seen a release since 2019) but the project is actively maintained again through 7.0.4 as of Jul 2025. Moves to {:logger_json, "~> 7.0"}. 7.0's API was redesigned around Elixir's :default_handler model: - config/config.exs: drops the old `config :logger_json, :backend, ...` key, which no longer exists - config/prod.exs: `backends: [LoggerJSON]` -> `default_handler: [formatter: {LoggerJSON.Formatters.Datadog, metadata: :all}]` -- must use the {Module, opts} tuple form, not `.new(...)`, since compile-time config evaluates before deps are compiled and calling `.new(...)` directly deadlocks a from-scratch `_build/prod` boot - endpoint.ex: removes `plug LoggerJSON.Plug, ...` (no longer a Plug module) - telemetry.ex: attaches LoggerJSON.Plug.telemetry_logging_handler/4 to the phoenix/endpoint/stop event, replacing what the removed endpoint plug used to do, mirroring the existing Ecto handler pattern * Bump Phoenix 1.7 -> 1.8 The 1.7 branch is EOL (last release Mar 2025); all security fixes since are 1.8-only. Bumps phoenix ~> 1.7.1 -> ~> 1.8 (1.7.12 -> 1.8.14). 1.8 removed the `namespace:` controller option recognizer's shared `RecognizerWeb.controller/0` macro used, and now requires an explicit `:formats` option. Fixed by reading Phoenix's actual source (__plugs__/2 in phoenix/lib/phoenix/controller.ex) rather than the compiler warning's suggested snippet, which would raise "no previous layout set" at the first HTML render: use Phoenix.Controller, formats: [html: "View", json: "View"] plug :put_new_layout, {RecognizerWeb.LayoutView, :app} This matches exactly what the old `namespace:` fallback did internally. Also adds `listeners: [Phoenix.CodeReloader]` to mix.exs -- a new required knob in 1.8 for the dev code-reloader (was printing a warning on every dev request otherwise). * Fix remaining pre-existing CVEs Fixes CVEs found in recognizer's own deps while validating the OTP 27 bump above, all pre-existing on master (confirmed via a pre-change mix.lock diff and a stash round-trip boot test): - guardian ~> 2.0 -> ~> 2.5 (2.3.2 -> 2.5.0, fixes 3 CVEs incl. forged-token revocation) - httpoison ~> 1.8.2 -> ~> 3.0 (1.8.2 -> 3.0.0; public HTTPoison.get/post/%Response{}/%Error{} API unchanged across majors, verified against call sites in hal.ex/client.ex) - joken ~> 2.6.0 -> ~> 2.7, pulling in jose ~> 1.11.12 (fixes the jose DoS CVE; jose isn't a direct dep) - plug_cowboy ~> 2.4 -> ~> 2.9 - cowboy/cowlib overrides ~> 2.8/~> 2.9.1 -> ~> 2.19/~> 2.20 (cowlib 2.9.1 had 7 CVEs; 2.20.0, the latest upstream release, still carries 3 unpatched ones -- nothing more to do via version bump) - hackney override ~> 4.0, needed because ex_aws_sqs's optional hackney ~> 1.9 dep conflicts with httpoison 3.0's hackney ~> 4.0 requirement; recognizer configures http_client: HTTPoison for ExAws in every env, so ex_aws_sqs's hackney-based adapter path is dead weight, not a real runtime pairing - decimal (transitive via ecto) was capped at 2.4.1 by myxql being stuck at 0.6.3, which capped ecto_sql below the 3.12+ that requires myxql ~> 0.8; unlocked myxql/ecto/ecto_sql/decimal together to let the whole chain move (myxql 0.6.3->0.9.0, ecto_sql 3.11.3->3.12.1, decimal 2.4.1->3.1.1) * Bump credo to fix Elixir 1.18 tokenizer crash credo 1.7.1 crashes on every file under Elixir 1.18 (CaseClauseError: :elixir_tokenizer.tokenize/3 now returns a 6-tuple). Bumps to 1.7.19, already allowed by mix.exs's existing ~> 1.5 constraint. --------- Co-authored-by: Yongjin Chong <zephyranthes03@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.