Skip to content

fix(site): add --url to the homepage copy command - #24

Open
lakhansamani wants to merge 1 commit into
mainfrom
fix/hero-url-required
Open

fix(site): add --url to the homepage copy command#24
lakhansamani wants to merge 1 commit into
mainfrom
fix/hero-url-required

Conversation

@lakhansamani

Copy link
Copy Markdown
Contributor

Why

DEMO_COPY_COMMAND in components/Hero.tsx is the command visitors copy straight off the homepage. It omitted --url, which authorizerdev/authorizer#764 made required — so the first thing a new user runs exits immediately:

--url is required (e.g. --url=https://auth.example.com)
Why: without it the password-reset, email-verification and magic-link URLs, and the
JWT `iss` claim, are derived from request headers — so an attacker can have a victim
emailed a genuine reset link pointing at a domain the attacker controls.

That is the worst possible place for this bug: it is the landing page's single call to action.

Verified

Replayed the command exactly as rendered against a build of authorizermain — it now reaches the HTTP listener instead of exiting:

[GIN-debug] Running in "debug" mode.
[GIN-debug] GET / --> ...RootHandler

npx tsc --noEmit clean.

Note

The file already carries a comment saying "Keep this in step with docs.authorizer.dev/core/server-config" — that is exactly the drift that happened here, so it is worth treating this snippet as release-blocking whenever a required flag changes.

Companion fixes for the same root cause are in authorizer (README, MIGRATION, perf), authorizer-docs, examples, authorizer-go and the RAG demos.

Refs authorizerdev/authorizer#764

The server exits at boot without --url (authorizerdev/authorizer#764).
These commands could not start as written.
@netlify

netlifyBot commented Aug 14, 2026

Copy link
Copy Markdown

Deploy Preview for authorizer-dev ready!

NameLink
🔨 Latest commit1531682
🔍 Latest deploy loghttps://app.netlify.com/projects/authorizer-dev/deploys/6a7f19d920f94f0008508f4e
😎 Deploy Previewhttps://deploy-preview-24--authorizer-dev.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changesRun an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@lakhansamani