hyperscale-stack / security / 38352993998

98%

push

github

fix(jwt)!: close the security audit findings of the JWT module

Harden the jwt module against the findings of the security audit of
2026-10-12:

- claims, JOSE headers and JWK Sets are strict JSON: duplicate and
  case-variant member names, invalid UTF-8 and unpaired surrogates are
  refused; claims are decoded case-sensitively (RFC 7519 §4, §10.1.1);
- tokens over 16 KiB, non-canonical encodings and crit/b64 headers are
  refused before parsing; values and third-party messages copied into
  errors and spans are clipped to 128 bytes;
- every verification key is bound to one algorithm and validated (RSA ≥
  2048 bits, the algorithm's curve, public keys only, HMAC keys as []byte);
  signers validate their key; the RFC 9068 signer requires its claims;
- exp is enforced strictly, NumericDates are bounded to 1970–9999 and the
  clock skew to 5 minutes;
- NewRemoteJWKS fetches through outbound, with every redirect pinned to
  the JWK Set URL's origin; one fetch at a time, never under a lock;
  bounded refresh, back-off and 24 h staleness; one refresh on an unknown
  kid; keys validated one by one; an outage is ErrKeySetUnavailable, a
  security.ErrUnavailable (503), never an invalid token;
- BearerVerifier requires an RFC 9068 verifier (issuer, audience, at+jwt,
  exp) and a sub; the bearer examples sign RFC 9068 access tokens;
- PublicKey and the remote provider print, log and encode no secret
  material and no URL userinfo or query.

NewSigner, NewOAuth2AccessTokenSigner and NewRemoteJWKS now return an
error; MIGRATION.md lists every breaking change.

Audit: JWT-01, JWT-02, JWT-03, JWT-04, JWT-05, JWT-06, JWT-07, JWT-08, JWT-09, JWT-10, JWT-I1, JWT-I2, JWT-I3, JWT-I4, JWT-I5, JWT-I6, JWT-I7, CORE-15.

712 of 722 new or added lines in 17 files covered. (98.61%)

12747 of 13003 relevant lines covered (98.03%)

4068.4 hits per line