hyperscale-stack / security / 38017422515

97%

Build Type

push

github

Committed by web-flow

Commit Message

fix(oauth2): revoke tokens issued from a replayed authorization code

RFC 6749 §4.1.2 says the tokens issued from a replayed authorization
code SHOULD be revoked, and RFC 9700 §4.2.4 relies on it against stolen
codes. Every store deleted a code as it consumed it, so a replay looked
like an unknown code, and issuance picked a random token family after
the consumption: nothing tied a code to its tokens, and the grant left
the first exchange's tokens alive.

The authorization_code grant now derives the token family from the code
hash (a domain-separated SHA-256, 22 characters) before consuming the
code. Stores keep a consumed code, flagged and without its raw value, at
least until it expires, and answer a replay with an
oauth2.CodeReplayError carrying the record; it matches
ErrCodeAlreadyUsed, and an unknown code still gets the bare sentinel.
The SQL store flags the row write-first in one READ COMMITTED
transaction (new consumed column); the Redis store flags the code's
JSON in one script with SET ... KEEPTTL and a per-call nonce, so a
go-redis resend after a lost reply still wins; the memory store keeps a
consumed set and no longer keeps the raw code.

A replay revokes the code's family only when it would itself have been
accepted: the code has not expired, and its client presents it with the
same redirect_uri and PKCE verifier and may still use the grant (OAuth
2.1 §4.1.3, §7.5.3). The revocation runs on a context detached from the
request; a failure is reported through grant.Config.OnError, and the
next proven replay retries it. Every replay answers the same bare
ErrCodeAlreadyUsed, so the response tells nothing about which check
failed. A replay landing before the first exchange persists its tokens
makes that exchange fail with invalid_grant; one landing after revokes
them.

This changes the AuthorizationCodeStore contract, adds a consumed
column to oauth2_auth_codes (existing tables need an ALTER TABLE) and a
flag to the Redis code payload; every in... (continued)

Coverage Stats

230 of 236 new or added lines in 11 files covered. (97.46%)

9 existing lines in 1 file now uncovered.

4828 of 5103 relevant lines covered (94.61%)

75.68 hits per line