Security Practices

// lib/auth/auth.ts
import { randomBytes } from 'node:crypto';

// Generate cryptographically secure code verifier
function generateCodeVerifier(): string {
  return randomBytes(32).toString('base64url');
}

// Derive code challenge from verifier
function generateCodeChallenge(verifier: string): string {
  return createHash('sha256')
    .update(verifier)
    .digest('base64url');
}

// lib/auth/auth.ts
export const CLIENT_ID = 'Iv1.b507a08c87ecfe98';
export const AUTHORIZE_URL = 'https://auth.openai.com/authorize';
export const TOKEN_URL = 'https://auth.openai.com/oauth/token';
export const REDIRECT_URI = 'http://127.0.0.1:1455/auth/callback';
export const SCOPE = 'openid profile email offline_access';

# Default storage location
~/.codex/multi-auth/
├── openai-codex-accounts.json        # Refresh tokens (primary pool)
├── openai-codex-flagged-accounts.json # Accounts with auth failures
├── quota-cache.json                   # Quota snapshots (no tokens)
└── settings.json                      # Configuration (no tokens)

// lib/auth/auth.ts
export function decodeJWT(token: string): unknown {
  const parts = token.split('.');
  if (parts.length !== 3) {
    throw new Error('Invalid JWT format');
  }
  
  const payload = parts[1];
  if (!payload) {
    throw new Error('Missing JWT payload');
  }
  
  // No signature verification (tokens are from trusted OAuth server)
  return JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
}

# Metadata logging (safe for most use cases)
ENABLE_PLUGIN_REQUEST_LOGGING=1 codex generate ...

# Full request/response body logging (SENSITIVE)
CODEX_PLUGIN_LOG_BODIES=1 codex generate ...

# Delete sensitive logs
rm -rf ~/.codex/multi-auth/logs/codex-plugin/

## Vulnerability Description
The OAuth state parameter is not validated during callback processing,
allowing CSRF attacks.

## Reproduction Steps
1. Start OAuth flow: `codex auth add`
2. Capture authorization URL
3. Modify `state` parameter in callback URL
4. Complete flow with modified state
5. Observe successful authentication despite state mismatch

## Impact Assessment
An attacker who can trick a user into clicking a malicious callback
URL could complete an OAuth flow with the attacker's authorization code,
linking the victim's Codex Multi-Auth installation to the attacker's
OpenAI account.

## Suggested Mitigation
Store the state parameter in memory during authorization and validate
it matches the callback state before exchanging the authorization code.

# Security audit (production dependencies only, high severity+)
npm run audit:prod

# Security audit (all dependencies, high severity+)
npm run audit:all

# Dev dependency audit with allowlist
npm run audit:dev:allowlist

# Full quality gate
npm run typecheck
npm run lint
npm test
npm run build

// lib/auth/auth.ts
export async function refreshAccessToken(
  refreshToken: string
): Promise<TokenResult> {
  const response = await fetch(TOKEN_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: CLIENT_ID,
    }),
  });
  
  const data = await response.json();
  
  // If new refresh token provided, update storage
  if (data.refresh_token) {
    await updateRefreshToken(data.refresh_token);
  }
  
  return { success: true, accessToken: data.access_token };
}

// lib/accounts.ts
class HealthScoreTracker {
  recordFailure(accountIndex: number): void {
    const score = this.getScore(accountIndex);
    const newScore = Math.max(
      score + this.config.failureDelta,  // Negative delta
      this.config.minScore
    );
    this.scores.set(accountIndex, newScore);
    this.consecutiveFailures.set(
      accountIndex,
      (this.consecutiveFailures.get(accountIndex) ?? 0) + 1
    );
  }
}

https://github.com/ndycode/codex-multi-auth/discussions