Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces security enhancements for OAuth2 authentication flows, including domain validation for authorization and token endpoints and sanitization of token response fields. It adds new configuration options via environment variables to control these security checks and whitelist specific domains. The feedback highlights the need for explicit error handling when using the secureAxiosRequest utility, as it does not throw on non-2xx status codes, and suggests adding type safety to the token field extraction logic to handle non-JSON responses gracefully.
| credentialId: credential.id, | ||
| tokenInfo: { | ||
| ...tokenData, | ||
| token_type: tokenData.token_type, |
There was a problem hiding this comment.
are we sure we just need token_type ? how bout other data inside tokenData ? the tokenData should be clean now with the new function extractOAuth2TokenFields right? why not pass in ...tokenData
3 participants
FLOWISE-566
FLOWISE-341
FLOWISE-524