Implement PKCE and sealed OAuth state flow#68

Merged

nicknisi merged 15 commits into

mainfrom

devin/1776802744-pkce-csrf

Apr 27, 2026

Commits on Apr 21, 2026

Implement PKCE and CSRF protection

devin-ai-integration[bot]
and
nicknisi
committed
Restore @workos-inc/node to runtime dependencies

devin-ai-integration[bot]
and
nicknisi
committed
Restore JSDoc above createAuthWithCodeResponse

devin-ai-integration[bot]
and
nicknisi
committed
Thread request through PKCE cookie Secure detection

devin-ai-integration[bot]
and
nicknisi
committed
Rewrite README and add migration guide for 0.10.0

devin-ai-integration[bot]
and
nicknisi
committed
Format pkce.spec.ts

devin-ai-integration[bot]
and
nicknisi
committed
Address follow-up review on PKCE cookie Secure detection

devin-ai-integration[bot]
and
nicknisi
committed
Format pkce.spec.ts

devin-ai-integration[bot]
and
nicknisi
committed
Sanitize returnPathname and preserve hash on callback

devin-ai-integration[bot]
and
nicknisi
committed
Preserve explicit returnPathname='/' in callback

devin-ai-integration[bot]
and
nicknisi
committed
Clear PKCE cookies on sign-out; doc sign-in endpoint

devin-ai-integration[bot]
and
nicknisi
committed
Format session.ts

devin-ai-integration[bot]
and
nicknisi
committed
Validate iss claim on access token

devin-ai-integration[bot]
and
nicknisi
committed
Clear PKCE cookie on error callback

devin-ai-integration[bot]
and
nicknisi
committed

Commits on Apr 23, 2026

Simplify PKCE callback comments and cleanup helper
nicknisi
committed