Fix FedCM authentication, scope consent, and code-binding issues

[pfefferle]

A review of the FedCM implementation (#299) turned up one functional blocker and several security/spec issues. Every fix was developed test-first; the failing test reproducing each issue was written before the fix.

Fixes

FedCM endpoints saw logged-in users as logged out (functional blocker)

accounts and assertion rely on is_user_logged_in(), but core's rest_cookie_check_errors() treats any cookie-authenticated REST request without a _wpnonce/X-WP-Nonce as unauthenticated. The browser's FedCM machinery can never send a REST nonce, so in a real browser the accounts endpoint always answered 401 and the flow dead-ended. (PHPUnit couldn't catch it: wp_set_current_user() doesn't set $wp_rest_auth_cookie, so the nonce path never ran in tests.)

The fix is a rest_authentication_errors filter that exempts requests bearing Sec-Fetch-Dest: webidentity — scoped to the plugin's fedcm/ routes only. Sec--prefixed headers are forbidden for cross-site JavaScript, so this does not open a CSRF hole; non-FedCM routes keep core's strict behavior (covered by tests).

RPs could obtain arbitrary-scope tokens without scope consent

The assertion endpoint accepted whatever params.scope the RP sent and the token endpoint then issued a real access token for it — but the FedCM browser dialog never displays scopes, so a one-click sign-in could silently become a create update token. Requested scopes are now clamped to profile/email; the indieauth_fedcm_scope filter still allows deliberate opt-up.

Code redemption never verified client_id/redirect_uri

verify_local_authorization_code() only checked PKCE — a code could be exchanged with a mismatched client_id or redirect_uri. Both are now enforced at the token endpoint. FedCM codes are issued without a redirect, so they are redeemable without a redirect_uri at both the token and authorization endpoints (keyed off the server-set fedcm marker), and the unused urn:ietf:wg:oauth:2.0:oob placeholder is no longer stored.

Smaller fixes

• Origin validation: a missing port now counts as the scheme default, so a client_id of https://app.example.com:443/ matches the browser's Origin: https://app.example.com.
• Error shape: assertion errors follow the FedCM Error API — {"error": {"code": "invalid_request" | "unauthorized_client" | "access_denied"}}.
• CORS: the public config.json and client_metadata endpoints send Access-Control-Allow-Origin: * without credentials; reflected credentialed CORS remains only on accounts/assertion where the spec requires it.

Testing instructions

1. npm run test:wp-env — 108 tests, includes new coverage for the nonce exemption (positive + two negative cases), scope clamping, code binding (mismatch rejection + FedCM redemption without redirect_uri), default-port origins, error shape, and public CORS.
2. Manual check of the critical fix on a wp-env site: log in, then
   curl -b <cookies> -H "Sec-Fetch-Dest: webidentity" <site>/wp-json/indieauth/1.0/fedcm/accounts
   returns the account list without a nonce; the same request without the header is still rejected, and core routes (e.g. /wp/v2/users/me) still 401 without a nonce even with the header.

Follow-ups (not in this PR)

• IdentityProvider.register() still fires on every dashboard load; it should probably move behind an explicit button on the settings page.
• The two code-redemption paths (authorization + token endpoint) still duplicate the verification mechanics; worth unifying into one shared verifier in a separate refactor.
• Worth one manual Chrome run to confirm the auth cookie (default SameSite=Lax) is attached to FedCM fetches; if not, FedCM-enabled sites need SameSite=None.

[Copilot]

Pull request overview

This PR hardens and unblocks the FedCM (Federated Credential Management) flow in the IndieAuth WordPress plugin by ensuring cookie-authenticated FedCM REST requests work without a REST nonce, clamping scopes to identity-safe values, and binding authorization codes to their original client parameters during redemption.

Changes:

• Exempt FedCM REST requests (scoped to the plugin’s FedCM routes) from WordPress REST cookie nonce enforcement.
• Clamp RP-requested scopes for FedCM assertion to profile/email, and align assertion error responses with the FedCM Error API shape.
• Enforce client_id and conditional redirect_uri binding during authorization code redemption (token + authorization endpoints), with corresponding PHPUnit coverage.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/phpunit/tests/includes/rest/class-test-token-controller.php	Adds tests for client_id/redirect_uri mismatch rejection and FedCM redemption without redirect_uri at the token endpoint.
tests/phpunit/tests/includes/rest/class-test-fedcm-controller.php	Adds tests for public CORS behavior, FedCM error shape, default-port origin handling, scope clamping, and REST nonce exemption behavior.
tests/phpunit/tests/includes/rest/class-test-authorization-controller.php	Adds a test ensuring FedCM codes can be redeemed without redirect_uri at the authorization endpoint.
includes/rest/class-token-controller.php	Makes redirect_uri optional at request-parse time and enforces client_id/redirect_uri binding during code verification (with FedCM exception).
includes/rest/class-fedcm-controller.php	Implements REST nonce exemption for FedCM routes, default-port origin equality, public CORS for non-user-data endpoints, FedCM Error API response shape, and scope clamping.
includes/rest/class-authorization-controller.php	Makes redirect_uri conditionally required based on whether the stored code is FedCM-marked.
includes/class-indieauth.php	Registers the FedCM REST-auth exemption filter.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.