mirror of
https://github.com/stripe/link-cli.git
synced 2026-09-14 16:41:26 +08:00
bensandler-stripe
4aa62ba34e
* Bind MPP credentials to the challenged destination - Follow unauthenticated redirects explicitly and bind the authenticated retry to the exact request that returned the 402 challenge, preventing a redirecting origin from receiving and replaying another server's Payment credential. - Preserve Fetch redirect method, body, and header rewrites while stripping sensitive headers across origins, and reject every redirect after credentials are attached. - Pin interactive challenge refreshes and agent continuations to the effective destination, and require HTTPS for remote MPP endpoints while retaining exact loopback HTTP for local development. - Cover five focused redirect/payment unit cases and 17 targeted built-CLI integration cases, including two new cross-origin credential-leak regressions. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> * Prevent approved MPP continuations from changing destination - Deferred agent continuations re-probed the pinned challenge URL while following redirects, allowing that destination to move after approval. - Route every approved spend request through one no-redirect challenge refresh and reject redirects before attaching the payment credential. - Add focused regression coverage for the pinned refresh and remove the obsolete expectation that approved requests may follow redirects. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> * Format approved redirect assertion - Collapse the approved redirect assertion to Biome’s single-line form. - Leave behavior unchanged; CI build and typechecks passed. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> * Clarify pinned MPP payment flow - Name the post-approval helper around its pinned-destination guarantee. - Explain why redirects stay visible to probe and payment callers. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> * Describe MPP challenge handling generically - Explain the status-and-header signing boundary without relying on mppx internals. - Keep response-body isolation and cleanup behavior unchanged. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> --------- Co-authored-by: codex <noreply@openai.com>
347 B
347 B
@stripe/link-cli
| @stripe/link-cli |
|---|
| patch |
Send MPP payment credentials only to the URL that returned the payment challenge. Approved spend requests and paid retries now reject redirects instead of moving credentials to a new destination. Remote MPP endpoints must use HTTPS; HTTP remains supported for exact loopback addresses used in local development.