hyperscale-stack / security / 39662903129

99%

master: 98%

Pull #135

github

fix(oauth2,oidc): address the review of the authorization-endpoint fixes

- CHANGELOG, MIGRATION and the architecture flow no longer describe the
  redirected server_error of a failed IssuerResolver: /authorize
  resolves the issuer first and answers a failure with a bare 500.
- The issuer rules compare with the form Go's net/url writes: spellings
  RFC 3986 §6.2 holds equivalent but net/url keeps (upper-case host,
  ":443", a leading-zero port, dot segments, an IPv6 zone) are accepted
  and published as given — documented, with the advice to use the RFC
  3986 §6.2.2 normal form that normalizing relying parties compare iss
  with (RFC 9207 §2.4).
- oidc/provider drops its issuer re-checks at /authorize and /token: the
  core validates the same issuers first, with the loopback setting New
  gives both, so they could no longer fail. The exchange test now pins
  the core's refusal (TestExchangeAtARefusedIssuerIssuesNoIDToken).
- Tests: port variance of a registered http://[::1] at /authorize, and
  the bodies of /token, /revoke and /introspect when the issuer is
  invalid (no issuer, no cause echoed). Comment and paragraph reflow.

Audit: F-03, F-04, I-01.

141 of 141 new or added lines in 9 files covered. (100.0%)

14831 of 15044 relevant lines covered (98.58%)

5202.97 hits per line