* fix: add CSRF protection to OAuth callback via HMAC-signed nonce
The OAuth state parameter was used only for passing application data
(returnTo, teamId) with no cryptographic binding to the user session.
An attacker could authorize their own account on a provider, capture the
authorization code, and trick a logged-in user into visiting the callback
URL to link the attacker's account to the victim's Cal.com profile.
Changes:
- encodeOAuthState: generate a random nonce and HMAC-sign it with
NEXTAUTH_SECRET + userId, injecting both into the OAuth state
- decodeOAuthState: verify the HMAC on callback using timingSafeEqual;
skip verification when nonce is absent (backwards compatible with apps
that don't yet use encodeOAuthState)
- Stripe callback: replace raw state.returnTo redirect with
getSafeRedirectUrl to prevent open redirect, remove redundant
getReturnToValueFromQueryState, add missing return on access_denied
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make CSRF nonce verification mandatory with allowlist for exempt apps
Makes nonce/HMAC verification mandatory by default in decodeOAuthState,
preventing attackers from bypassing CSRF protection by omitting nonce
fields from the state parameter.
Apps not yet migrated to encodeOAuthState (stripe, basecamp3, dub,
webex, tandem) are explicitly allowlisted and pass their slug to
decodeOAuthState to skip verification.
Addresses review feedback (identified by cubic) about the conditional
check being trivially bypassable.
Co-Authored-By: unknown <>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
