Skip to content

fix: OIDC 토큰 엔드포인트 CSRF 체크 비활성화 - #27

Merged
mack-erel merged 1 commit into
mainfrom
csrf
Apr 20, 2026
Merged

fix: OIDC 토큰 엔드포인트 CSRF 체크 비활성화#27
mack-erel merged 1 commit into
mainfrom
csrf

Conversation

@mack-erel

Copy link
Copy Markdown
Owner

Summary

  • svelte.config.jscsrf: { checkOrigin: false } 추가
  • OIDC/SAML 엔드포인트는 서비스 프로바이더(SP)에서 cross-origin으로 호출하므로 SvelteKit의 CSRF 체크가 토큰 교환을 차단하는 문제 수정
  • UI 폼의 CSRF는 OIDC state 파라미터가 동일하게 보호함

Test plan

  • SP에서 OIDC Authorization Code + PKCE 플로우로 토큰 교환 성공 확인
  • 로그인 UI 폼 정상 동작 확인

🤖 Generated with Claude Code

@mack-erel
mack-erel merged commit 0762a6e into main Apr 20, 2026
6 checks passed
@mack-erel
mack-erel deleted the csrf branch April 20, 2026 06:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant