stacklok / toolhive / 29412915156

push

github

Validate aud and resource claims in returned ID-JAG JWT (#5716)

The XAA IdP exchange (RFC 8693) returned an ID-JAG JWT without
validating its aud or resource claims against the values requested in
the exchange. If the IdP minted an ID-JAG for a different audience or
resource, ToolHive forwarded it to the target AS unchanged — a token-
misbinding / confused-deputy risk.

Add validateIDJAGClaims to check the aud claim (REQUIRED per draft
§3.1, membership check per RFC 7519 §4.1.3) and the resource claim
(OPTIONAL per §3.1, validated when one was requested) inside the
returned ID-JAG JWT. A non-JWT assertion that fails to parse is now
rejected rather than forwarded. The typ header check remains logged-
only by design (the draft §3.1 MUST is on the issuer; ToolHive is the
holder/presenter).

Closes #5696

49 of 51 new or added lines in 1 file covered. (96.08%)

73526 of 108119 relevant lines covered (68.0%)

63.46 hits per line