From 0479149b2d2bdc6fb1499072638fdb19e7082bed Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:08:19 +0100
Subject: [PATCH 1/2] fix(auth): require HTTPS authentication URLs

---
 sdk/typescript/src/auth.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sdk/typescript/src/auth.ts b/sdk/typescript/src/auth.ts
index e45a0ea71..107c0306b 100644
--- a/sdk/typescript/src/auth.ts
+++ b/sdk/typescript/src/auth.ts
@@ -243,7 +243,9 @@ function preferredAuthUrl(value: string): string | null {
   )) {
     const url = match[0].replace(/[.,;:!?)\]}]+$/, "");
     try {
-      const hostname = new URL(url).hostname.toLowerCase().replace(/\.$/, "");
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:") continue;
+      const hostname = parsed.hostname.toLowerCase().replace(/\.$/, "");
       if (
         hostname !== "localhost" &&
         !hostname.endsWith(".localhost") &&

From 3319857e0ff65d473ec7a71ebfa083751aab32f4 Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:09:50 +0100
Subject: [PATCH 2/2] test(auth): reject plaintext login destinations

---
 sdk/typescript/tests-ts/auth-http-url.test.ts | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 sdk/typescript/tests-ts/auth-http-url.test.ts

diff --git a/sdk/typescript/tests-ts/auth-http-url.test.ts b/sdk/typescript/tests-ts/auth-http-url.test.ts
new file mode 100644
index 000000000..91831d4a3
--- /dev/null
+++ b/sdk/typescript/tests-ts/auth-http-url.test.ts
@@ -0,0 +1,33 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "bun:test";
+import { CodexLoginHandle } from "../src/auth.js";
+
+test("skips external plaintext HTTP authentication URLs", async () => {
+  const root = await mkdtemp(join(tmpdir(), "codex-security-auth-http-"));
+  const script = join(root, "login.mjs");
+  try {
+    await writeFile(
+      script,
+      `
+console.error("Open http://auth.example.test/insecure");
+console.error("Open https://auth.example.test/device");
+console.error("User code: ABCD-EFGH");
+process.exit(0);
+`,
+    );
+    const handle = new CodexLoginHandle(
+      { command: process.execPath },
+      [script],
+      process.env,
+      () => {},
+    );
+
+    await expect(handle.wait()).resolves.toMatchObject({ success: true });
+    expect(handle.verificationUrl).toBe("https://auth.example.test/device");
+    expect(handle.userCode).toBe("ABCD-EFGH");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});