[simonvanlierde]

Summary

The OAuth callbacks answered 500 to a made-up code, because httpx-oauth trades the code with the provider before the app checks state. This checks state first and answers 400 when the provider refuses the code.

Type of change

• 🚀 feat: New feature
• 🐛 fix: Bug fix
• 🛠️ build: Build system or dependency changes
• 🔄 ci: CI configuration changes
• 📚 docs: Documentation only changes
• 🏎️ perf: Performance improvement
• ♻️ refactor: Code refactoring (no functional changes)
• 🎨 style: Code style/formatting changes
• ✅ test: Adding or updating tests
• 🔧 chore: Other maintenance work

Why

• base.py now verifies the state JWT and CSRF cookie before the code goes to GitHub or Google. A 4xx from the provider gives 400, and no answer or a 5xx gives 502. GitHub's 200 with an error body also gives 400.
• Schemathesis now fuzzes the callbacks too: I dropped the exclude(path_regex=...) and its TODO. A fuzzed state never verifies, so the fuzz never reaches the providers.
• The test Postgres container gets a 300 s Docker timeout. docker-py's 60 s wasn't enough when the daemon is busy.

Checklist

• I've read the contributing guidelines
• Code follows style guidelines and passes quality checks (just ci)
• Unit tests added/updated and passing locally (just test)
• Documentation updated (if applicable)
• Database migrations created (if applicable)

Security, if relevant

• Assets affected: OAuth login and account-linking callbacks.
• Trust boundary changed: none. An unverified state no longer reaches the provider.
• Secure default/failure mode: a bad state or a refused code gives 400, a provider outage gives 502, never 500.
• Controls and tests: tests/unit/auth/test_oauth_callback.py, plus the Schemathesis fuzz on the callbacks.

Notes for reviewers

Tests: the 67 OAuth unit tests pass, and pytest tests/integration -k schemathesis passes (2 tests, 140 subtests). With the old base.py, 7 unit tests and 11 fuzz cases fail with the 500. I didn't run the full just ci. The fuzz test doesn't block the network itself, so nothing stops a future change that lets a fuzzed state reach the providers.

[codspeed]

Merging this PR will not alter performance

✅ 7 untouched benchmarks

---

_{Comparing oauth-callback-state-first (e88d106) with main (fc0925a)¹}

Footnotes

1. No successful run was found on main (423388d) during the generation of this report, so fc0925a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!