FIWARE / VCVerifier / 36138807027

70%

main: 73%

Pull #128

github

fix(verifier): stop using the external client's state as the session key

The cross-device and same-device login flows reserved the session cache
entry under the state value supplied by the external OIDC client
(sessionCache.Add(state, ...), three call sites), and echoed that same
value back to the wallet as the OID4VP request's own state. Since go-cache's
Add fails if the key already exists, any client that resends the same state
across a retry (a page refresh, a double-submit, a back-button retry, or
simply a client that doesn't randomize state per attempt) got a hard
failure instead of being able to proceed.

Generate the verifier's own session id for every flow, and use it as the
sessionCache key, the wallet-facing OID4VP state, and the request_uri
lookup key. The external client's original state is now stored separately
on the session (loginSession.externalState) and is only ever echoed back to
that client at the very end, never used as a lookup key - so a repeated or
predictable external state can no longer collide with, or address, a
session it didn't create.

Response.SessionId is renamed to Response.ExternalState to make this
distinction explicit at the one place most likely to regress it: a
same-device or cross-device response must always echo the external state,
never the verifier's internal session id.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

18 of 31 new or added lines in 3 files covered. (58.06%)

7683 of 11012 relevant lines covered (69.77%)

0.8 hits per line