hyperscale-stack / security / 38359824905

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(oauth2)!: harden the authorization server endpoints

Harden the OAuth2 authorization server endpoints (internal security audit
of 2026-10-12); completes the client policy of #114.

- /authorize: framing, caching and referrer headers on every response; a
  POST is answered with 303; registered redirect URIs are validated
  (ValidateRedirectURI: absolute, no fragment, a host and a valid port for
  http(s), no userinfo, RFC 8252 private-use schemes) and their query is
  kept byte for byte, with code/state/iss appended exactly once.
- New opt-in AuthorizeConfig.TrustedRedirect: errors detected before the
  resource owner authenticated are a bare page for untrusted clients,
  never a redirect (RFC 9700 §4.11.2).
- Bounded requests (ServerConfig.MaxRequestBytes, 64 KiB by default),
  nonce, state and client_id.
- Every failed client authentication answers the same bytes; client-store
  and token-lookup failures are failures (500 / 503), not invalid_client.
- /introspect and /revoke are bound to the request issuer; without a
  policy a refresh token introspects for its own client only; a foreign
  token is answered like an unknown one.
- The RFC 8414 metadata reflects the server (GET and HEAD only) and the
  OpenID Provider's discovery document publishes the same auth-method
  lists; the OpenID Provider serves no implicit flow (its AuthorizeHandler
  panics on AllowImplicit).
- The memory store keeps token hashes only; the storetest suite fails a
  store that returns a raw token. DefaultClient.SecretMatches compares
  SHA-256 digests in constant time.

Breaking changes and migration steps: MIGRATION.md.

Audit: OAUTH-04, OAUTH-05, OAUTH-06, OAUTH-10, OAUTH-11, STORE-01, STORE-03, OAUTH-I3, OAUTH-I4, OAUTH-I5, OAUTH-I8, OAUTH-I9, OAUTH-I10, OAUTH-I11.

Coverage Stats

394 of 394 new or added lines in 19 files covered. (100.0%)

1 existing line in 1 file now uncovered.

13313 of 13554 relevant lines covered (98.22%)

5085.46 hits per line