hyperscale-stack / security / 38244951342

98%

push

github

test(oidc): add interoperability, negative security tests and conformance coverage

Runs the relying party of oidc/client against the provider of
oidc/provider over HTTP in a new private test module,
internal/interop/oidcstack. It covers the code flow with every signing
algorithm (#85's last criterion), mix-up, re-signed and substituted ID
Tokens, code injection, PKCE downgrade, replay, refresh reuse, key
rotation, concurrent callbacks across replicas, and provider, store and
network faults. Opt-in runs exercise the transaction stores on real
PostgreSQL, MySQL and Redis. The PR also adds: more of the provider
through go-oidc, more of the client against zitadel and a pinned
metadata corpus, the two examples run together, Tales suites against
their binaries, and an opt-in OpenID Foundation conformance-suite
harness. docs/oidc-conformance.md records the results; it is no
certification.

Two flaws fixed on the way. An oidc/client login transaction is now
MACed with a required server-held key (Config.TransactionKeys), not the
browser's binding secret alone: a store writer could relax max_age or
acr_values (a step-up bypass). The token endpoint refuses a
code_verifier for a code issued without code_challenge, under every
profile (RFC 9700 §4.8.2, PKCE downgrade). The client's types,
oauth2.DefaultClient, the jwtsec keys and the values holding them, and
session.Codec now print, log and encode without their secrets, whatever
the fmt verb.

TransactionKeys is a breaking configuration change; MIGRATION.md
describes it, the /token refusal, and the jwtsec JSON encoding.
Refs #86.

183 of 183 new or added lines in 9 files covered. (100.0%)

12534 of 12864 relevant lines covered (97.43%)

1744.88 hits per line