hyperscale-stack / security / 38328810166

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(oidc): close the security audit findings of the OIDC client

Discovery and JWK Set requests now follow redirects only within the
origin of the URL requested — the issuer's, the jwks_uri's — whatever
Outbound.MaxRedirects allows (OpenID Connect Discovery 1.0 §7.2); token
and UserInfo requests still never follow any, now pinned for same-origin
redirects too.

AuthRequest, Callback and Config encode to JSON without their secrets
(redacting MarshalJSON, json:"-" on the secret fields for flattened
embeddings), so slog's JSON handler no longer writes them when nested;
Identity and Tokens stay JSON-serialisable by design. UserInfo prints and
logs its subject only.

AuthOptions.ExtraParams can no longer spell a reserved parameter in
another case or with '.' for '_', repeat a parameter of the authorization
endpoint's query, or repeat each other (RFC 6749 §3.1); New refuses an
endpoint query that does.

Provider-controlled text echoed into errors — issuer, media type,
redirect target, JOSE header member, HTTP/2 GOAWAY debug data — is quoted,
then cut to about 256 bytes. StartLogin expires only binding cookies, never
the application's own oidc-* cookies. The docs now say to decode claims
with DecodeClaims: a lone case-variant member is another claim, kept as
OpenID Connect Core §2 requires.

memory.WithCapacity bounds the in-memory transaction store (O(1)
refusal, no eviction); the oidc-client example rate-limits login starts
per client and per network and caps its store. Migration: MIGRATION.md.

Audit: RP-01, RP-02, RP-03, RP-04, RP-I1, RP-I2, RP-I3, RP-I4.

Coverage Stats

184 of 184 new or added lines in 12 files covered. (100.0%)

1 existing line in 1 file now uncovered.

11040 of 11354 relevant lines covered (97.23%)

1945.35 hits per line