Harden OAuth sessions and patch vulnerable dependencies (#2000)

* Update YAML, URI, and serialization dependencies

* Harden sessions, credential traces, and runtime dependencies

* Require HTTPS for cloud outbound requests

* Normalize dependency resolution for frozen installs

* Prebundle browser telemetry before cloud development starts

Author: RhysSullivan

.changeset/tidy-trace-secrets.md

@@ -0,0 +1,8 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/api": patch
+---
+
+Redact redirect, referrer, trace-state, and MCP session headers from outbound HTTP traces.
+
+Allow hosts to require HTTPS for outbound requests and reject redirects to plaintext endpoints. Executor Cloud enables this policy. Explicit private-network development access remains available.

.changeset/update-openapi-yaml-parser.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/plugin-openapi": patch
+---
+
+Update the YAML parser to include fixes for malformed-input denial of service.

apps/cloud/package.json

@@ -58,12 +58,12 @@
     "@jitl/quickjs-wasmfile-release-sync": "catalog:",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "~1.9.0",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.214.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.214.0",
-    "@opentelemetry/resources": "^2.6.1",
-    "@opentelemetry/sdk-logs": "^0.214.0",
-    "@opentelemetry/sdk-trace-base": "^2.6.1",
-    "@opentelemetry/sdk-trace-web": "^2.6.1",
+    "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
+    "@opentelemetry/resources": "^2.9.0",
+    "@opentelemetry/sdk-logs": "^0.220.0",
+    "@opentelemetry/sdk-trace-base": "^2.9.0",
+    "@opentelemetry/sdk-trace-web": "^2.9.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@sentry/cloudflare": "^10.48.0",
     "@sentry/react": "^10.48.0",

apps/cloud/src/auth/access-token-options.ts

@@ -0,0 +1,7 @@
+import type { JWTVerifyOptions } from "jose";
+
+/** Require expiring WorkOS tokens and cap local verification at 24 hours. */
+export const workosAccessTokenOptions: JWTVerifyOptions = {
+  requiredClaims: ["exp", "iat"],
+  maxTokenAge: "24h",
+};

apps/cloud/src/auth/api.ts

@@ -65,9 +65,9 @@ const CliLoginResponse = Schema.Struct({
   clientId: Schema.String,
 });
 
-// `state` is optional — some WorkOS-initiated redirects arrive at the
-// callback without the state we set on /auth/login. The CSRF check is
-// only enforced when state is present (see callback handler).
+// Decode missing state so the callback can reject it with the same explicit
+// login-state failure as a mismatched value. Every successful callback must
+// match the state cookie created by /auth/login.
 const AuthCallbackSearch = Schema.Struct({
   code: Schema.String,
   state: Schema.optional(Schema.String),

apps/cloud/src/auth/handlers.ts

@@ -317,7 +317,10 @@ export const CloudAuthPublicHandlers = HttpApiBuilder.group(
           // make the next page load optimistically paint the app shell for a
           // signed-out browser.
           return deleteResponseCookie(
-            deleteResponseCookie(response, "wos-session"),
+            deleteResponseCookie(
+              HttpServerResponse.setHeader(response, "Clear-Site-Data", '"cache", "storage"'),
+              "wos-session",
+            ),
             AUTH_HINT_COOKIE,
           );
         }),

apps/cloud/src/auth/workos-callback-state.node.test.ts

@@ -164,3 +164,29 @@ describe("workos callback · CSRF state hardening", () => {
     expect(replay.status).toBe(400);
   });
 });
+
+describe("logout browser cleanup", () => {
+  it("clears browser storage when the browser presents an auth hint", async () => {
+    const response = await run(
+      new Request("https://executor.test/auth/logout", {
+        method: "POST",
+        headers: { cookie: "executor-auth-hint=1" },
+        redirect: "manual",
+      }),
+    );
+    expect(response.status).toBe(302);
+    expect(response.headers.get("clear-site-data")).toBe('"cache", "storage"');
+    expect(response.headers.get("set-cookie")).toContain("Max-Age=0");
+  });
+
+  it("does not clear storage for a request without same-site cookies", async () => {
+    const response = await run(
+      new Request("https://executor.test/auth/logout", {
+        method: "POST",
+        redirect: "manual",
+      }),
+    );
+    expect(response.status).toBe(302);
+    expect(response.headers.get("clear-site-data")).toBeNull();
+  });
+});

apps/cloud/src/auth/workos.ts

@@ -7,6 +7,7 @@ import { Context, Data, Effect, Layer, Option, Predicate, Schema } from "effect"
 import { GeneratePortalLinkIntent, WorkOS } from "@workos-inc/node/worker";
 import { defaults as ironDefaults, unseal as unsealIron } from "iron-webcrypto";
 import { decodeJwt, jwtVerify } from "jose";
+import { workosAccessTokenOptions } from "./access-token-options";
 import { JWKSInvalid, JWKSNoMatchingKey, JWKSTimeout } from "jose/errors";
 import { parseCookie } from "./cookies";
 import { createCachedRemoteJWKSet, type CachedRemoteJWKSet } from "./jwks-cache";
@@ -179,7 +180,7 @@ const getWorkOSSessionJwks = (() => {
 
 const verifyJwtOnce = (accessToken: string, jwks: CachedRemoteJWKSet) =>
   Effect.tryPromise({
-    try: () => jwtVerify(accessToken, jwks),
+    try: () => jwtVerify(accessToken, jwks, workosAccessTokenOptions),
     catch: (cause) => new ServiceAdapterError({ cause }),
   });
 

apps/cloud/src/engine/execution-stack.ts

@@ -96,6 +96,7 @@ export const CloudHostConfig: Layer.Layer<HostConfig> = Layer.sync(HostConfig, (
   // the e2e dev-server env opts in with `"true"` so in-scenario fixture
   // servers on localhost are reachable. See `hosted-http-client.ts`.
   allowLocalNetwork: env.ALLOW_LOCAL_NETWORK === "true",
+  requireTls: true,
   webBaseUrl: env.VITE_PUBLIC_SITE_URL ?? "https://executor.sh",
   oauthCallbackPath: `${CLOUD_MOUNT_PREFIX}/oauth/callback`,
   // WorkOS Vault is cloud's credential storage implementation detail, not a

apps/cloud/src/mcp/jwt.ts

@@ -7,9 +7,26 @@
 // the dependency points one way only.
 // ---------------------------------------------------------------------------
 
-import { Data, Effect, Result, Schema } from "effect";
+import { Data, Effect, Option, Result, Schema } from "effect";
 import { jwtVerify, type JWTVerifyGetKey } from "jose";
 import { JWKSInvalid, JWKSTimeout, JWTExpired } from "jose/errors";
+import { workosAccessTokenOptions } from "../auth/access-token-options";
+
+const parseIdentityClaims = Schema.decodeUnknownOption(
+  Schema.Struct({
+    sub: Schema.NonEmptyString,
+    org_id: Schema.optionalKey(Schema.NullOr(Schema.NonEmptyString)),
+  }),
+);
+
+const identityFromClaims = (payload: unknown): VerifiedToken | null =>
+  Option.match(parseIdentityClaims(payload), {
+    onNone: () => null,
+    onSome: (claims) => ({
+      accountId: claims.sub,
+      organizationId: claims.org_id ?? null,
+    }),
+  });
 
 export type VerifiedToken = {
   /** The WorkOS account ID (user ID). */
@@ -91,18 +108,14 @@ export const verifyMcpAccessToken = (
     const { payload } = yield* Effect.tryPromise({
       try: () =>
         jwtVerify(token, jwks, {
+          ...workosAccessTokenOptions,
           issuer: options.issuer,
           audience: options.audience,
         }),
       catch: classifyJwtVerificationError,
     }).pipe(withJwtVerificationSpan);
 
-    if (!payload.sub) return null;
-
-    return {
-      accountId: payload.sub,
-      organizationId: (payload.org_id as string | undefined) ?? null,
-    } satisfies VerifiedToken;
+    return identityFromClaims(payload);
   });
 
 export const verifyWorkOSMcpAccessToken = (
@@ -134,14 +147,9 @@ export const verifyWorkOSMcpAccessToken = (
 export const verifyWorkosUserManagementToken = (token: string, jwks: JWTVerifyGetKey) =>
   Effect.gen(function* () {
     const { payload } = yield* Effect.tryPromise({
-      try: () => jwtVerify(token, jwks),
+      try: () => jwtVerify(token, jwks, workosAccessTokenOptions),
       catch: classifyJwtVerificationError,
     }).pipe(withJwtVerificationSpan);
 
-    if (!payload.sub) return null;
-
-    return {
-      accountId: payload.sub,
-      organizationId: (payload.org_id as string | undefined) ?? null,
-    } satisfies VerifiedToken;
+    return identityFromClaims(payload);
   });