HarperFast/oauth

View on GitHub

A Harper plugin for OAuth 2.0 and OpenID Connect authentication with multi-provider support.

Stars: 1
Forks: 1
Open beginner issues: 0
Indexed issues: 13
Avg merge: 2d 16h
Merged PRs (30d): 12

Dominant language: JavaScript
License: Apache-2.0
Last GitHub push: Sep 14, 2026
Latest indexed: Sep 17, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Open All

13 open issues indexed

MCP OAuth v1.1: remaining 2026-07-28 spec forward-work (SEP-2350 scope step-up) Open

enhancement

HarperFast/oauth#156 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 17, 2026
Conformance audit: MCP authorization spec 2026-07-28 (docs pin 2025-06-18 — two revisions stale) Open

HarperFast/oauth#202 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
2.5.0: unresolved env placeholder on an mcp boolean gate now drops to its default (behavior change not in CHANGELOG) Open

HarperFast/oauth#207 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Remove the http://localhost:9926 redirectUri fallback — silent loopback default turns missing config into an authorization-code interception hazard Open

HarperFast/oauth#208 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Session invalidation is not atomic vs a concurrent token refresh — logout/expiry can be resurrected (no CAS) Open

bug

HarperFast/oauth#212 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
A request that invalidates an OAuth session still runs once as the old user (global middleware next() without clearing request.user) Open

bug

HarperFast/oauth#213 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
mcp.signingKeyPem resolving to empty string silently switches from pinned key to self-generated (no startup validation) Open

HarperFast/oauth#221 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Harden the sessionValidator periodic-validation regression test to assert persistence (follow-up to #223) Open

HarperFast/oauth#224 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
/login propagates CSRF-state storage failures as a raw error response; /callback redirects with a reason code Open

HarperFast/oauth#227 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Support selecting which email becomes the login identity when a provider returns several (e.g. GitHub) Open

enhancement

HarperFast/oauth#228 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
MCP: reject pre-provenance refresh families at refresh time (lazy migration, defense in depth) Open

enhancement

HarperFast/oauth#229 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Integration test: prove a verified login adopts an existing account and inherits its role Open

enhancement

HarperFast/oauth#230 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Follow-up hardening after the account-adoption gate (GHSA-vf58 / 2.6.0) Open

HarperFast/oauth#231 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026

HarperFast/oauth

Get new issues in your inbox