feat: Replace local login server with OAuth 2.0 Device Authorization Grant#12170
Draft
anthonyshew wants to merge 6 commits intomainfrom
Draft
feat: Replace local login server with OAuth 2.0 Device Authorization Grant#12170anthonyshew wants to merge 6 commits intomainfrom
anthonyshew wants to merge 6 commits intomainfrom
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
f6e81b5 to
7c0673e
Compare
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
7c0673e to
b0dad2a
Compare
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
b0dad2a to
9ba486a
Compare
Contributor
Coverage Report
|
…Grant (RFC 8628) Replace the axum-based localhost HTTP server login flow with the OAuth 2.0 Device Authorization Grant (RFC 8628). The user now visits a URL and enters a code in the browser instead of relying on a localhost redirect. - Add device_flow module implementing RFC 8628 (discover, device auth, token polling, introspection) - Remove login_server.rs, axum/axum-server/async-trait/anyhow dependencies - Remove TURBO_SSO_LOGIN_CALLBACK_PORT env var and sso_login_callback_port config - SSO flow still uses a one-shot TcpListener for redirect, now with spawn_blocking, bounded reads, timeouts, and CSRF state validation - Write OAuth tokens to both Vercel CLI auth.json and turbo config.json - Custom Debug impl on TokenSet to redact secrets - Validate OIDC discovery endpoint origins against issuer domain - Derive OIDC issuer from login_url to support self-hosted deployments
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
9ba486a to
d44e9ee
Compare
anthonyshew
commented
Mar 5, 2026
apps/docs/content/docs/reference/system-environment-variables.mdx
Outdated
Show resolved
Hide resolved
anthonyshew
commented
Mar 5, 2026
apps/docs/content/docs/reference/system-environment-variables.mdx
Outdated
Show resolved
Hide resolved
AAorris
approved these changes
Mar 9, 2026
AAorris
left a comment
AAorris
left a comment
There was a problem hiding this comment.
One line change recommended: Display user_code on its own in the log.
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
95fd8d5 to
413823b
Compare
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
413823b to
db294fb
Compare
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
db294fb to
5b94cb5
Compare
- Display user_code during device flow per RFC 8628 §3.3 MUST requirement - Loop listener.accept in login/SSO redirects to handle browser preflight and favicon requests instead of consuming the single-shot listener - Deduplicate is_vercel into auth/mod.rs - Add subdomain validation test proving ends_with check is correct - Add CSPRNG note on rand::random() usage for CSRF state generation
anthonyshew
force-pushed
the
shew/stop-login-server
branch
from
5b94cb5 to
4efe178
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
For Vercel logins only, replaces the axum-based localhost HTTP callback server with the OAuth 2.0 Device Authorization Grant (RFC 8628). Instead of spawning a local server and redirecting the browser back to
127.0.0.1:9789, the user visits a URL and enters a code directly in the browser.Non-Vercel logins (self-hosted remote caches) are unchanged in behavior — they still use the localhost redirect flow with the same URL patterns and the same configurable callback port. The only difference is the implementation: a simple one-shot
TcpListenerinstead of axum.Why: The localhost server approach is fragile for Vercel logins (port conflicts, firewall rules, WSL networking, SSH sessions, containers). The device flow works everywhere — including headless environments — with no open ports required.
Non-Vercel users
No behavioral change. The
TURBO_SSO_LOGIN_CALLBACK_PORTenv var andsso_login_callback_portconfig option are preserved and continue to work for non-Vercel login/SSO flows.Breaking Changes
LoginServertrait removed — tests usingMockLoginServerneed to be updatedlogin()andsso_login()now return(Token, Option<TokenSet>)instead ofTokenHow to Test
Non-Vercel login can be tested by configuring a
loginUrlthat doesn't containvercel.com— it will use the old localhost redirect flow with the same URL patterns.