get not post

[emrgnt-cmplxty]

Important

Change HTTP method from POST to GET for OAuth callback functions in UsersClient and update version in package.json.

• Behavior:
  • Change HTTP method from POST to GET for oauthGoogleCallback and oauthGithubCallback in UsersClient.
• Versioning:
  • Update version in package.json from 0.4.13 to 0.4.14.

^{This description was created by for 98a0e59. It will automatically update as commits are pushed.}

[ellipsis-dev]

👍 Looks good to me! Reviewed everything up to 98a0e59 in 40 seconds

More details

• Looked at 34 lines of code in 2 files
• Skipped 0 files when reviewing.
• Skipped posting 1 drafted comments based on config settings.

1. js/sdk/src/v3/clients/users.ts:545

• Draft comment:
  Changing the method from POST to GET for OAuth callbacks might expose sensitive information in URLs. Typically, POST is used for such callbacks to ensure data security.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable:

1. OAuth 2.0 specification explicitly allows and even recommends GET for authorization code callbacks. 2. The parameters being passed (code and state) are designed to be temporary and safe to include in URLs. 3. The code parameter is a one-time use token, and the state parameter is for CSRF protection - both are meant to be in URLs. 4. This is standard OAuth implementation practice.
   I could be wrong about the specific OAuth implementation details of this system. There might be additional sensitive data being passed that I can't see.
   Even if there were additional data being passed, the code shows that only code and state are included as parameters, which are standard URL parameters in OAuth flows.
   The comment should be deleted as it raises an invalid security concern. Using GET with these parameters is actually the standard practice in OAuth 2.0 implementations.

Workflow ID: wflow_LN90Q5wXkyJRhWhY

---

You can customize Ellipsis with 👍 / 👎 feedback, review rules, user-specific overrides, quiet mode, and more.