hyperscale-stack / security / 39652075769

98%

push

github

fix(jwt)!: close the jwt findings of the 2026-10-21 security audit

Close the jwt findings of the security audit of 2026-10-21.

- RSASSA-PSS (PS256/384/512) signatures must use a salt of the hash size
  (RFC 7518 §3.5); signers backed by an opaque key check every PS*
  signature they produce, so the library never emits a token it refuses.
- Ed25519 public keys must be canonical and not of small order, and an
  Ed25519 private key must match its seed (RFC 8032 §5.1.3).
- The decoded JOSE header is bounded to 4 KiB before any decoding.
- HMAC signers write the kid header, so key rotation keeps working; a
  single HMAC key with another KeyID now refuses the token.
- StandardClaims exposes client_id and AccessTokenPrincipal tells client
  tokens from user tokens (SubjectIsClient, for refusing access only;
  RFC 9700 §4.15.1).
- BearerVerifier can check that a token is still active through
  WithActiveTokenCheck (ErrTokenInactive → 401, an unavailable check →
  503); the hook gets a copy of the claims.
- ECDSA's two valid signature forms stay accepted and are documented.

Breaking changes and migration steps: MIGRATION.md.

Audit: F-08, F-09, I-11, I-12, I-13, D-03, D-15.

135 of 135 new or added lines in 9 files covered. (100.0%)

14010 of 14222 relevant lines covered (98.51%)

5284.74 hits per line