Bind MPP credentials to the challenged destination - #319
Draft
bensandler-stripe wants to merge 3 commits into
Draft
Bind MPP credentials to the challenged destination#319bensandler-stripe wants to merge 3 commits into
bensandler-stripe wants to merge 3 commits into
Conversation
- Follow unauthenticated redirects explicitly and bind the authenticated retry to the exact request that returned the 402 challenge, preventing a redirecting origin from receiving and replaying another server's Payment credential. - Preserve Fetch redirect method, body, and header rewrites while stripping sensitive headers across origins, and reject every redirect after credentials are attached. - Pin interactive challenge refreshes and agent continuations to the effective destination, and require HTTPS for remote MPP endpoints while retaining exact loopback HTTP for local development. - Cover five focused redirect/payment unit cases and 17 targeted built-CLI integration cases, including two new cross-origin credential-leak regressions. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
- Deferred agent continuations re-probed the pinned challenge URL while following redirects, allowing that destination to move after approval. - Route every approved spend request through one no-redirect challenge refresh and reject redirects before attaching the payment credential. - Add focused regression coverage for the pinned refresh and remove the obsolete expectation that approved requests may follow redirects. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
bensandler-stripe
force-pushed
the
bensandler/fix-mpp-credential-redirects
branch
from
September 11, 2026 02:29
c084b79 to
3bba1f9
Compare
- Collapse the approved redirect assertion to Biome’s single-line form. - Leave behavior unchanged; CI build and typechecks passed. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
402challenge.