fix: Prevent named-pipe squatting in Windows example app via FILE_FLAG_FIRST_PIPE_INSTANCE

[NandanPrabhu]

Summary

• CreateNamedPipeW in the Windows example app's redirect-forwarding pipe server now passes FILE_FLAG_FIRST_PIPE_INSTANCE, so pipe creation fails if a pipe with the same name already exists.
• This closes a squatting window where an attacker (running as the same user) could pre-create the pipe before the app starts, causing later client connections to round-robin onto their instance instead of ours.
• This is additional defense-in-depth on top of the SID-restricted pipe ACL and callback-prefix validation already in main.

Test plan

• Build the Windows example app and confirm normal single-instance / protocol-redirect login flow still works
• Verify a second app launch (simulating the OS protocol-activation path) still forwards the callback URI to the first instance correctly
• Confirm CreateNamedPipeW failure (e.g. simulated pre-existing pipe) is handled gracefully — pipe server thread exits rather than crashing

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• auth0_flutter/example/windows/runner/main.cpp is excluded by !**/example/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce19a7dc-5b03-47cb-b769-9d91c9bb2297

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sec-9754-named-pipe-first-instance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}