hyperscale-stack / security / 38354809306

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(oidc)!: close the security audit findings of the OpenID Provider

Close the security audit findings of the OpenID Provider (oidcprovider)
and its example (internal security audit of 2026-10-12).

- Claim names are compared under a variant key that matches how relying
  parties read them (Go's case-insensitive folding, lodash camelCase and
  deburr): a source attribute such as "ſub", "Email" or "email‐verified"
  can no longer be released next to, or instead of, the claim it aliases;
  New refuses such names in ClaimsSupported; numbers beyond float64 are
  dropped from released claims (OP-01).
- prompt, ui_locales, claims_locales and acr_values are parsed without
  per-separator allocation and bounded (OP-02).
- offline_access is kept only when the Decision grants it, on every
  request, and is ignored outside the authorization code flow (OIDC
  Core §11) (OP-03).
- The example binds consent answers to the end-user who gave them,
  grants offline access and remembers consent only as shown, bounds
  pending logins, equalises login timing and sets server timeouts (OP-04).
- The provider keeps its own copies of its configuration, pins each
  issuer's key ring, passes voluntary acr requests to the Interaction
  (merged into ACRValues) and documents its remaining limits
  (OP-I1..OP-I6).
- Following #114, an empty parameter occurrence is treated as omitted
  (RFC 6749 §3.1), like the oauth2 core: no parser differential.

Breaking changes and migration steps: MIGRATION.md.

Audit: OP-01, OP-02, OP-03, OP-04, OP-I1, OP-I2, OP-I3, OP-I4, OP-I5, OP-I6, OAUTH-I1.

Coverage Stats

290 of 290 new or added lines in 9 files covered. (100.0%)

6 existing lines in 2 files now uncovered.

12994 of 13256 relevant lines covered (98.02%)

5188.27 hits per line