hyperscale-stack / security / 39651116395

99%

master: 98%

Build Type

Pull #125

github

Committed by euskadi31

Commit Message

docs(oidc/client): state the limits of Secret and the persistence break

The documentation of oidcclient.Secret overstated its reach and left
out the runtime break of persisted values:

- encoding/gob refuses any value holding a Secret, so a gob-encoded
  session holding an Identity fails to save; YAML writes a Secret
  empty; documents persisted before the upgrade no longer decode.
  MIGRATION gives the rows and a struct-of-strings recipe.
- fmt prints a Secret it reaches through an unexported field as an
  address, not REDACTED, and a reflection dumper that dereferences
  pointers without calling methods (go-spew with DisableMethods, as in
  testify's failure diffs) prints its value; embedding a Secret makes
  the whole struct print REDACTED.
- AuthRequest.URL carries every request parameter in clear, the
  id_token_hint included: its renderings drop the query, its JSON
  hand-off does not. The renderings test now covers the hint.

The DefaultCapacity memory figure also counts acr_values.

Audit: F-11, I-14, D-12.

Pull Request Pull Request #125: fix(oidc/client)!: close the security audit findings of the OIDC client

Coverage Stats

110 of 110 new or added lines in 14 files covered. (100.0%)

3 existing lines in 1 file now uncovered.

13950 of 14165 relevant lines covered (98.48%)

5008.37 hits per line