fix: confirm same-session external partial resumes

Author: nijel

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [5.0.1](https://github.com/python-social-auth/social-core/releases/tag/5.0.1) - 2026-06-24
+
+### Security
+
+- Externally resumable partial request links now require confirmation even in
+  the browser session that created the partial, preventing validation links from
+  being consumed by a plain GET.
+
 ## [5.0.0](https://github.com/python-social-auth/social-core/releases/tag/5.0.0) - 2026-06-23
 
 ### Security

pyproject.toml

@@ -59,7 +59,7 @@ license-files = ["LICENSE"]
 name = "social-auth-core"
 readme = "README.md"
 requires-python = ">=3.10"
-version = "5.0.0"
+version = "5.0.1"
 
 [project.optional-dependencies]
 all = [

social_core/tests/test_utils.py

@@ -260,6 +260,98 @@ def test_returns_partial_when_request_token_matches_session_id(self) -> None:
         self.assertIsNotNone(partial)
         backend.strategy.partial_load.assert_called_once_with("session-token")
 
+    def test_same_session_external_resume_requires_confirmation(self) -> None:
+        response = object()
+        backend = self._backend(
+            request_data={
+                "partial_token": "session-token",
+                "verification_code": "123456",
+            },
+            partial_data={PARTIAL_PIPELINE_ALLOW_EXTERNAL_RESUME: True},
+        )
+        backend.strategy.partial_pipeline_external_resume_confirmation.return_value = (
+            response
+        )
+
+        result = partial_pipeline_result(backend)
+
+        self.assertIsNone(result.partial)
+        self.assertEqual(result.response, response)
+        self.assertFalse(result.halt)
+        backend.strategy.session_set.assert_any_call(
+            PARTIAL_TOKEN_PENDING_SESSION_NAME, "session-token"
+        )
+        backend.strategy.session_set.assert_any_call(
+            PARTIAL_TOKEN_PENDING_REQUEST_SESSION_NAME,
+            {"partial_token": "session-token", "verification_code": "123456"},
+        )
+
+    def test_same_session_external_resume_rejects_initial_confirmation(self) -> None:
+        response = object()
+        backend = self._backend(
+            request_data={
+                "partial_token": "session-token",
+                "partial_pipeline_confirm": "1",
+                "verification_code": "123456",
+            },
+            partial_data={PARTIAL_PIPELINE_ALLOW_EXTERNAL_RESUME: True},
+        )
+        backend.strategy.partial_pipeline_external_resume_confirmation.return_value = (
+            response
+        )
+
+        result = partial_pipeline_result(backend)
+
+        self.assertIsNone(result.partial)
+        self.assertEqual(result.response, response)
+        backend.strategy.partial_pipeline_external_resume_confirmed.assert_not_called()
+        backend.strategy.session_set.assert_any_call(
+            PARTIAL_TOKEN_PENDING_SESSION_NAME, "session-token"
+        )
+        backend.strategy.session_set.assert_any_call(
+            PARTIAL_TOKEN_PENDING_REQUEST_SESSION_NAME,
+            {
+                "partial_token": "session-token",
+                "partial_pipeline_confirm": "1",
+                "verification_code": "123456",
+            },
+        )
+
+    def test_same_session_external_resume_without_request_data_resumes(self) -> None:
+        backend = self._backend(
+            partial_data={PARTIAL_PIPELINE_ALLOW_EXTERNAL_RESUME: True},
+        )
+
+        result = partial_pipeline_result(backend)
+
+        self.assertIsNotNone(result.partial)
+        backend.strategy.partial_pipeline_external_resume_confirmation.assert_not_called()
+
+    def test_same_session_external_resume_without_request_token_requires_confirmation(
+        self,
+    ) -> None:
+        response = object()
+        backend = self._backend(
+            request_data={"verification_code": "123456"},
+            partial_data={PARTIAL_PIPELINE_ALLOW_EXTERNAL_RESUME: True},
+        )
+        backend.strategy.partial_pipeline_external_resume_confirmation.return_value = (
+            response
+        )
+
+        result = partial_pipeline_result(backend)
+
+        self.assertIsNone(result.partial)
+        self.assertEqual(result.response, response)
+        self.assertFalse(result.halt)
+        backend.strategy.session_set.assert_any_call(
+            PARTIAL_TOKEN_PENDING_SESSION_NAME, "session-token"
+        )
+        backend.strategy.session_set.assert_any_call(
+            PARTIAL_TOKEN_PENDING_REQUEST_SESSION_NAME,
+            {"verification_code": "123456"},
+        )
+
     def test_request_token_without_session_match_is_halted(self) -> None:
         backend = self._backend(
             request_data={"partial_token": "attacker-token"},
@@ -406,6 +498,33 @@ def test_confirmed_external_resume_uses_pending_request_data(self) -> None:
             result.partial.kwargs["request"]["partial_pipeline_confirm"], "1"
         )
 
+    def test_confirmed_same_session_resume_uses_pending_request_data(self) -> None:
+        backend = self._backend(
+            request_data={
+                "partial_token": "session-token",
+                "partial_pipeline_confirm": "1",
+            },
+            pending_resume={
+                "token": "session-token",
+                "request": {
+                    "partial_token": "session-token",
+                    "verification_code": "123456",
+                },
+            },
+            partial_data={PARTIAL_PIPELINE_ALLOW_EXTERNAL_RESUME: True},
+        )
+
+        result = partial_pipeline_result(backend, request=object())
+
+        self.assertIsNotNone(result.partial)
+        assert result.partial is not None
+        self.assertEqual(
+            result.partial.kwargs["request"]["partial_token"], "session-token"
+        )
+        self.assertEqual(
+            result.partial.kwargs["request"]["verification_code"], "123456"
+        )
+
     def test_clean_pipeline_when_uid_does_not_match(self) -> None:
         backend = self._backend({"uid": "foo@example.com"})
         backend.strategy.request_data.return_value = {backend.ID_KEY: "bar@example.com"}

social_core/utils.py

@@ -230,9 +230,6 @@ def _select_partial_pipeline_token(
     pending_token: str | None,
     confirmation_requested: bool,
 ) -> PartialPipelineSelection:
-    if request_token and request_token == session_token:
-        return PartialPipelineSelection(token=request_token, owns_token=True)
-
     if confirmation_requested and pending_token:
         selected_token = request_token or pending_token
         pending_resume = selected_token == pending_token
@@ -242,12 +239,28 @@ def _select_partial_pipeline_token(
             pending_resume=pending_resume,
         )
 
+    if request_token and request_token == session_token:
+        return PartialPipelineSelection(token=request_token, owns_token=True)
+
     if request_token:
         return PartialPipelineSelection(token=request_token)
 
     return PartialPipelineSelection(token=session_token, owns_token=bool(session_token))
 
 
+def _partial_pipeline_requires_confirmation(
+    partial: PartialMixin,
+    request_token: str | None,
+    request_data: dict[str, Any],
+    pending_resume: bool,
+) -> bool:
+    return bool(
+        not pending_resume
+        and partial.data.get(PARTIAL_PIPELINE_ALLOW_EXTERNAL_RESUME)
+        and (request_token or request_data)
+    )
+
+
 def _confirmed_partial_pipeline_request_data(
     backend: BaseAuth,
     request_data: dict[str, Any],
@@ -338,7 +351,16 @@ def partial_pipeline_result(
         backend, partial, effective_request_data
     )
     if partial and partial_matches:
-        if selection.owns_token:
+        if _partial_pipeline_requires_confirmation(
+            partial,
+            request_token,
+            effective_request_data,
+            selection.pending_resume,
+        ):
+            result = _external_partial_pipeline_result(
+                backend, partial, selection.token, effective_request_data
+            )
+        elif selection.owns_token:
             result = PartialPipelineResult(
                 partial=_extend_partial_pipeline(
                     partial, effective_request_data, user, kwargs