mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 08:13:50 +00:00
Linus Rath
49e8d08c23
The code exchange, token refresh and revocation POSTs carry the authorization code, refresh token and client secret, and used a plain `fetch` that follows redirects. The endpoints come from a validated discovery document, but a redirect from them (or from an endpoint that changed after discovery) re-sent the body to a host nobody validated. These requests now fail on any redirect. A failed refresh still keeps the refresh token, as for any other outage.