hyperscale-stack / security / 38214798495

98%

push

github

feat(oidc): add an OpenID Connect relying party and an SSRF-safe outbound client

Applications need to log users in through external OpenID Providers -
an identity broker federating enterprise IdPs, or an application behind
one - and obtain a verified identity, while the URLs they fetch often
come from tenants. The core gains outbound, a stdlib-only sub-package
whose NewClient(Policy) judges the address actually dialed (DNS
rebinding safe), refuses non-public, numeric and non-canonical
destinations before the CheckURL hook, follows no redirect, uses no
proxy and bounds time, headers and bodies; refused addresses are never
named in errors.

The oidc/client module (package oidcclient, core + go-jose only) is a
relying party, one Client per connection: discovery with an exact
issuer match, Authorization Code with PKCE S256, state and nonce in the
query or form_post mode, client_secret_basic/post or a public client.
A login is bound to its browser by a binding secret in an HttpOnly
__Host- cookie from which the nonce, the PKCE verifier and the key of a
MAC over every transaction field derive, so the store holds no secret
and an altered transaction fails (a self-run login can still be
relaxed by a store writer: documented). Transactions are consumed once;
Complete requires the callback URL to be the connection's redirect URI
(RFC 9700 §4.4.2.2) and checks RFC 9207 iss when advertised. ID Tokens
are validated per OIDC Core §3.1.3.7 with asymmetric algorithms only, a
bounded JWK Set cache and strict JSON; UserInfo checks sub.

Memory, SQL and Redis transaction stores share the storetest conformance
suite; the client interoperates with zitadel/oidc, an opt-in Chrome test
checks the SameSite cookies, and examples/oidc-client links accounts on
(connection, issuer, subject). go-oidc was evaluated and rejected. The
code flow against the library's own provider is left to #86.
Refs #85.

2406 of 2430 new or added lines in 27 files covered. (99.01%)

7708 of 7975 relevant lines covered (96.65%)

1177.89 hits per line