hyperscale-stack / security / 38329686941

98%

push

github

fix(oauth2)!: enforce a fail-closed client policy

A public or untyped client obtained client_credentials tokens (RFC 6749
§4.4: confidential clients only), and a client declaring no grant type or
no scope was allowed every grant and any scope. The OAuth2 server now
applies a fail-closed client policy. A client gets only the grant types
and scopes it declares, compared exactly, an empty list allowing nothing.
/token checks the declaration for every grant, custom ones included,
before the grant runs; /authorize checks it for the code and implicit
flows. A refresh re-checks the client's current scope registration. The
consent step only narrows the requested scope, and a refresh token goes
only to a client declaring refresh_token.

Every client that is not confidential needs PKCE, and rotates its refresh
tokens, under every profile (RFC 9700 §2.1.1, §4.14.2). Scope values are
parsed once, strictly (RFC 6749 §3.3, at most 100 tokens and 4096 bytes),
compared in linear time and issued canonical. Repeated parameters, and
several client-authentication methods in one request, are refused (RFC
6749 §3.1, §3.2, §2.3); an empty occurrence counts as omitted. A repeated
client_id, redirect_uri or response_mode at /authorize is a bare 400.
/token requires redirect_uri only when /authorize received one (§4.1.3).
An opt-in RefreshFamilyTTL bounds the lifetime of a refresh-token family.
Code consumption before validation is documented as a design choice.

Breaking: client registrations must declare their grants and scopes, and
two SQL columns (redirect_uri_omitted, family_issued_at) are added before
deploying. MIGRATION.md has a section per change.

Audit: OAUTH-01, OAUTH-02, OAUTH-03, OAUTH-07, OAUTH-08, OAUTH-09, OAUTH-I1, OAUTH-I2, OAUTH-I6, OAUTH-I7, OAUTH-I12, OAUTH-I13, OAUTH-I14.

413 of 413 new or added lines in 26 files covered. (100.0%)

11298 of 11610 relevant lines covered (97.31%)

1911.51 hits per line