Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: feathersjs/feathers
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v5.0.47
Choose a base ref
...
head repository: feathersjs/feathers
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v5.0.48
Choose a head ref
  • 3 commits
  • 66 files changed
  • 1 contributor

Commits on Aug 11, 2026

  1. docs(authentication): clarify OAuth authStrategies security (#3698) 

    Document that OAuth providers belong under authentication.oauth and
must not be listed in public authStrategies for browser redirect SSO.
Rewrite flow #2 guidance so provider-token login requires a verifying
getProfile, and cross-link guides and cookbooks.
    @marshallswain
    marshallswain authored Aug 11, 2026
    Configuration menu
    Copy the full SHA
    15f5ee9 View commit details
    Browse the repository at this point in the history

  2. fix(authentication-oauth): allow any port on loopback OAuth origins (#… 

    …3699)

* fix(authentication-oauth): allow any port on loopback OAuth origins

Exact origin matching from the 5.0.40 security fix rejected common local
dev setups where the frontend runs on a different port than the configured
origin (e.g. http://localhost vs http://localhost:5173).

For localhost, 127.0.0.1, and ::1 only, match on scheme + host and ignore
port, then redirect using the referer origin so the token returns to the
correct local port. Non-loopback hosts still require an exact origin match.

Closes #3684

* fix(authentication-oauth): treat 0.0.0.0 as loopback and improve origin errors

Include 0.0.0.0 in the loopback port-flex allowlist used for local OAuth
redirects. When a referer is rejected, report the normalized origin,
configured allowlist, and a short hint about ports and loopback matching.
    @marshallswain
    marshallswain authored Aug 11, 2026
    Configuration menu
    Copy the full SHA
    1a58896 View commit details
    Browse the repository at this point in the history

  3. chore(release): publish v5.0.48

    @marshallswain
    marshallswain committed Aug 11, 2026
    Configuration menu
    Copy the full SHA
    e541397 View commit details
    Browse the repository at this point in the history
Loading