Repository navigation
docs(playbooks): downstream port playbook for the 2026-09-28 security review - #103
Merged
Merged
Conversation
…view Forks copy MPNext rather than install it, so nothing notifies them of the 2026-09-28/29 security review fixes. port-downstream-hardening.md deferred that work to "its own phase"; this is it. .claude/playbooks/port-security-review-2026-09-28.md covers every change on main since v2026.09.13.0207 that the earlier playbook does not: boot guards (secret, TEST, BETTER_AUTH_SECRETS, env URLs), 12 h / JWE / refreshCache:false sessions and token stripping, the shared auth instance + discovery rebuild + logout id_token_hint, OIDC claim checks, the /sign-in/social size and Content-Type cap, rate-limit IP config, fail-closed roles, the MP HTTP client and provider-service hardening (deny-all procedures, trusted sender), pick allowlists and Made_By-as-author, proxy/header/UI hardening (/signed-out, SessionGuard, cross-tab sign-out), the Flight-promise and header-shift fixes, server-only guards, Next 16.3.7, and CI pinning/build/prerender checks. It opens with a breaking-changes table and a triage script. The script was checked against main (no ✗) and against the pre-review baseline ea2e0ad (37 ✗). The two existing pointers to the follow-up now name the playbook. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
chriskehayias
added a commit
that referenced
this pull request
Sep 30, 2026
port-security-review-2026-09-28.md was published (#103) telling forks to port the selfHealingAuth rebuild facade; PR #107 replaced that with no boot-time discovery a few hours later. A fork that already ran that playbook has no reason to re-open it, and the #101 port was only a sketch spread across three documents. port-oidc-lazy-discovery.md is a self-contained delta playbook: - triage into four fork states (discoveryUrl + facade, discoveryUrl only, explicit endpoints without id_token verification, done), with greps checked against main, the pre-#107 file and the pre-facade file; - a read-only check of the fork's own MP discovery document (connect/* paths, RS256, jwks_uri not to be pinned, RFC 9207 flag); - the full code (lazyIdTokenVerifier, verifyMpIdToken, provider config, getUserInfo), jose as a direct dependency and the relock-script fix; - what to delete if the facade was ported, and which log events changed; - the test changes (mock OIDC modes, the regression suite, signed tokens for direct getUserInfo tests, alg confusion, mutation check); - verification: the issue's repro against next start with an https fake MP, and the real-MP sign-in/sign-out smoke test; - PR callouts and a checklist. The 2026-09-28 playbook's Phase 4, port-downstream-hardening.md and the downstream hardening playbook now point to it as the full procedure. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.claude/playbooks/port-security-review-2026-09-28.md, a Claude Code playbook that downstream forks can use to port every hardening change onmainsincev2026.09.13.0207thatport-downstream-hardening.mddoesn't already cover.mainand 37 ✗ on the pre-review baselineea2e0ad. Then come 18 phases, a production-build verification list, the known-open items, and a SHA-by-phase reading list.port-downstream-hardening.mdanddocs/security/downstream-hardening-playbook.mdnow name the new playbook.Docs only; no code changes.
🤖 Generated with Claude Code