Overview - Forgerock

forgerockWorkspace

CI Pipeline Executions
- Filtered
Runs
Demo

Insights

Compare tasks
Analytics

Overview

forgerock

Loading workspace stats

Loading workspace insights...

Statistics interval

7 days30 days

Latest CI Pipeline Executions

Filter

Fuzzy

Sort by

© 2026 - Nx Cloud

Terms of Service Privacy Policy Changelog Status Docs Contact Nx Cloud Pricing Company @NxDevTools

forgerockWorkspace

Average execution time

1m 6s

4 CI pipeline executions

Computation time saved

1m 38s

Cache hit rate

66%

Protect cache integrity with sandboxing

Time to Green

n/a

Needs more runs to compute

Succeeded
595
718aef5f fix(token-vault): route session logout through the vault (SDKS-5448)
by Vatsal Parikh
V
Succeeded
595
3a205582 refactor(token-vault): use FRUser.logout with vault-routed sessions (SDKS-5448)
by Vatsal Parikh
V
Succeeded
595
158025cc fix(token-vault): route session logout through the vault (SDKS-5448)
by Vatsal Parikh
V
Succeeded
595
08608534 fix(token-vault): end SSO session before clearing vault tokens (SDKS-5448)
by Vatsal Parikh
V
Succeeded
594
9d8fa98e fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
504ed2c5 fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
59b91d73 fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
669926b6 fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
0bd288ad fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
c37b7b28 fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
a6c423e2 fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448)
by Vatsal Parikh
V
Succeeded
594
84b34d4c fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448)
by Vatsal Parikh
V
Succeeded
594
5c47b24f fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448)
by Vatsal Parikh
V
Canceled
594
8d0aede0 fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448)
by Vatsal Parikh
V
Succeeded
594
c9737e1c fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) Alternative to exact-match URL classification: the three token-carrying branches keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
594
841fac7f fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448) Alternative to exact-match URL classification: the three token-carrying branches keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. No percent-decoding required.
by Vatsal Parikh
V
Succeeded
593
03f814ab fix(token-vault): replace substring endpoint dispatch with exact AM endpoint matching (SDKS-5448) Dispatch compared request URLs with substring checks, letting app-origin XSS route raw tokens to arbitrary paths (query params like ?cb=token/revoke) and bypass the only redacting branch via percent-encoding (%61ccess_token). Dispatch now compares scheme + host + percent-decoded path against the computed AM endpoint URLs, and redaction (default-deny) is applied to every response branch instead of only the token endpoint branch.
by Vatsal Parikh
V
Succeeded
593
41b5bf47 fix(token-vault): replace substring endpoint dispatch with exact AM endpoint matching (SDKS-5448) Dispatch compared request URLs with substring checks, letting app-origin XSS route raw tokens to arbitrary paths (query params like ?cb=token/revoke) and bypass the only redacting branch via percent-encoding (%61ccess_token). Dispatch now compares scheme + host + percent-decoded path against the computed AM endpoint URLs, and redaction (default-deny) is applied to every response branch instead of only the token endpoint branch.
by Vatsal Parikh
V
Succeeded
593
96064c73 fix(token-vault): replace substring endpoint dispatch with exact AM endpoint matching (SDKS-5448) Dispatch compared request URLs with substring checks, letting app-origin XSS route raw tokens to arbitrary paths (query params like ?cb=token/revoke) and bypass the only redacting branch via percent-encoding (%61ccess_token). Dispatch now compares scheme + host + percent-decoded path against the computed AM endpoint URLs, and redaction (default-deny) is applied to every response branch instead of only the token endpoint branch.
by Vatsal Parikh
V
Canceled
593
96064c73 fix(token-vault): replace substring endpoint dispatch with exact AM endpoint matching (SDKS-5448) Dispatch compared request URLs with substring checks, letting app-origin XSS route raw tokens to arbitrary paths (query params like ?cb=token/revoke) and bypass the only redacting branch via percent-encoding (%61ccess_token). Dispatch now compares scheme + host + percent-decoded path against the computed AM endpoint URLs, and redaction (default-deny) is applied to every response branch instead of only the token endpoint branch.
by Vatsal Parikh
V