vynte-infra/calendar

Fork 0

Files

T

History

14c151be76 fix: add CSRF protection to OAuth callback via HMAC-signed nonce (#28083 )

* fix: add CSRF protection to OAuth callback via HMAC-signed nonce

The OAuth state parameter was used only for passing application data
(returnTo, teamId) with no cryptographic binding to the user session.
An attacker could authorize their own account on a provider, capture the
authorization code, and trick a logged-in user into visiting the callback
URL to link the attacker's account to the victim's Cal.com profile.

Changes:
- encodeOAuthState: generate a random nonce and HMAC-sign it with
  NEXTAUTH_SECRET + userId, injecting both into the OAuth state
- decodeOAuthState: verify the HMAC on callback using timingSafeEqual;
  skip verification when nonce is absent (backwards compatible with apps
  that don't yet use encodeOAuthState)
- Stripe callback: replace raw state.returnTo redirect with
  getSafeRedirectUrl to prevent open redirect, remove redundant
  getReturnToValueFromQueryState, add missing return on access_denied

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: make CSRF nonce verification mandatory with allowlist for exempt apps

Makes nonce/HMAC verification mandatory by default in decodeOAuthState,
preventing attackers from bypassing CSRF protection by omitting nonce
fields from the state parameter.

Apps not yet migrated to encodeOAuthState (stripe, basecamp3, dub,
webex, tandem) are explicitly allowlisted and pass their slug to
decodeOAuthState to skip verification.

Addresses review feedback (identified by cubic) about the conditional
check being trivially bypassable.

Co-Authored-By: unknown <>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-02-20 10:35:01 +00:00

api

fix: add CSRF protection to OAuth callback via HMAC-signed nonce (#28083 )

2026-02-20 10:35:01 +00:00

components

feat: upgrade tailwind v4 (#24598 )

2025-11-25 17:32:28 -03:00

lib

refactor: Move repositories from @calcom/lib to @calcom/features domain folders (#27570 )

2026-02-09 08:41:04 -03:00

pages/setup

fix: initiate OAuth flow in setup page instead of redirecting to dashboard for stripe (#27608 )

2026-02-04 13:45:40 +00:00

static

#4252 Use vercel og to generate og images for meetings and apps. (#4943 )

2022-10-18 11:46:22 -06:00

_metadata.ts

fix: inline package.json descriptions in app-store _metadata.ts to fix Vitest RPC errors (#27931 )

2026-02-13 08:41:39 -03:00

DESCRIPTION.md

chore/AppStore: Remove deprecated imageSrc and make the paths relative in logo (#8479 )

2023-04-26 12:03:34 +01:00

index.ts

feat/payment-service-6438-cal-767 (#6677 )

2023-02-08 13:36:22 -07:00

LICENSE

change /ee to /commercial (#8948 )

2023-05-25 17:50:30 +00:00

package.json

chore: lock all package versions to match yarn.lock (#26204 )

2025-12-26 11:54:30 -03:00

README.md

App Store (#1869 )

2022-03-23 15:00:30 -07:00

zod.ts

feat: add time-based cancellation fees for no-show fee events (#23595 )

2025-09-05 21:46:54 +04:00

README.md

Get Started with Enterprise

Enterprise Edition

Welcome to the Enterprise Edition ("/ee") of Cal.com.

The /ee subfolder is the place for all the Pro features from our hosted plan and enterprise-grade features such as SSO, SAML, ADFS, OIDC, SCIM, SIEM, HRIS and much more.

❗ WARNING: This package is copyrighted (unlike our main repo). You are not allowed to use this code to host your own version of app.cal.com without obtaining a proper license first❗

Setting up Stripe

Create a stripe account or use an existing one. For testing, you should use all stripe dashboard functions with the Test-Mode toggle in the top right activated.
Open Stripe ApiKeys save the token starting with pk_... to NEXT_PUBLIC_STRIPE_PUBLIC_KEY and sk_... to STRIPE_PRIVATE_KEY in the .env file.
Open Stripe Connect Settings and activate OAuth for Standard Accounts
Add <CALENDSO URL>/api/integrations/stripepayment/callback as redirect URL.
Copy your client*id (ca*...) to STRIPE_CLIENT_ID in the .env file.
Open Stripe Webhooks and add <CALENDSO URL>/api/integrations/stripepayment/webhook as webhook for connected applications.
Select all payment_intent events for the webhook.
Copy the webhook secret (whsec_...) to STRIPE_WEBHOOK_SECRET in the .env file.