hyperscale-stack / security / 39586142126

99%

master: 98%

Pull #125

github

docs(oidc/client): state the limits of Secret and the persistence break

The documentation of oidcclient.Secret overstated its reach and left
out the runtime break of persisted values:

- encoding/gob refuses any value holding a Secret, so a gob-encoded
  session holding an Identity fails to save; YAML writes a Secret
  empty; documents persisted before the upgrade no longer decode.
  MIGRATION gives the rows and a struct-of-strings recipe.
- fmt prints a Secret it reaches through an unexported field as an
  address, not REDACTED, and a reflection dumper that dereferences
  pointers without calling methods (go-spew with DisableMethods, as in
  testify's failure diffs) prints its value; embedding a Secret makes
  the whole struct print REDACTED.
- AuthRequest.URL carries every request parameter in clear, the
  id_token_hint included: its renderings drop the query, its JSON
  hand-off does not. The renderings test now covers the hint.

The DefaultCapacity memory figure also counts acr_values.

Audit: F-11, I-14, D-12.

110 of 110 new or added lines in 14 files covered. (100.0%)

13952 of 14165 relevant lines covered (98.5%)

5008.4 hits per line