tecnickcom / nurago / 29401775615
100%

Ran 15 Jul 2026 08:46AM UTC

Jobs 1

Files 202

Run time 1min

Badge

Committed 15 Jul 2026 08:42AM UTC coverage: 100.0%. Remained the same

Build # 29401775615

Build Type

push

github

Committed by

Commit Message

feat(jwt): harden session-lifetime, JOSE header, and token-size handling

Correctness and security hardening of pkg/jwt from a multi-pass source audit. The core design is unchanged: HMAC is pinned by configuration, the signature is verified before the claims payload is decoded, every current and previous key is length-checked, comparisons are constant-time, and every rejection returns the same opaque 401.

- Clamp `exp` to the max session lifetime so `WithMaxSessionLifetime` is a true absolute bound; a renewal granted just under the cap previously still issued a full further expiration window, making the real bound `maxSessionLifetime + expirationTime`.
- Parse the JOSE header in a single strict pass: reject a `crit` parameter (RFC 7515 §4.1.11) and any duplicate header member (closing the last-wins duplicate-`alg` case), while still ignoring unknown parameters.
- Bound token size on both paths with a shared `ErrTokenTooLarge`: cap a token accepted for verification and refuse to sign one that would exceed the cap (e.g. a very long username), so the package never mints a token it would then reject. Adds `WithMaxTokenBytes` and `DefaultMaxTokenBytes`.
- Reject configurations that whole-second `exp` stamping cannot represent: `New` refuses a sub-second `expirationTime` or `maxSessionLifetime`, and a renewal that would mint a born-expired token is refused rather than returned with a 200.
- Improve diagnostics: `ErrWeakKey` now names the offending key (signing, or previous by index), and a refused renewal logs its actual cause (session cap vs whole-second truncation).
- Document the clock-skew leeway interactions: the effective absolute session bound is `maxSessionLifetime + clockSkewLeeway`, and the leeway extends every token's effective lifetime, so keep it small relative to the expiration time.

New exported API: WithMaxTokenBytes, DefaultMaxTokenBytes, ErrTokenTooLarge, ErrUnsupportedCritHeader, ErrDuplicateHeaderParameter, ErrInvalidMaxTokenBytes, Err... (continued)

Coverage Stats

17311 of 17311 relevant lines covered (100.0%)

14461.59 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	29401775615.1	15 Jul 2026 08:46AM UTC	202	100.0	GitHub Action Run

Source Files on build 29401775615