hyperscale-stack / security / 39674179875

98%

push

github

fix(oauth2,oidc)!: harden the authorization endpoint, issuer and metadata

Harden the authorization endpoint, the issuer and the metadata after the
security audit of 2026-10-21.

- Redirect URIs: outside Profile20 an http redirect URI must be the
  RFC 8252 §7.3 loopback IP literal; ValidateRedirectURI takes the
  profile (F-03, RFC 9700 §2.6).
- Issuer: every resolved issuer is validated (https, host, no userinfo,
  query or fragment; http loopback only with AllowInsecureLoopbackIssuer);
  NewServer refuses an invalid StaticIssuer (F-04, RFC 8414 §2,
  RFC 9207).
- /authorize resolves the issuer before loading any client; a resolver
  failure is a bare 500, never redirected; every authorization response
  carries iss (I-01).
- Missing response_type → invalid_request; response_type=code without
  the authorization_code grant → unsupported_response_type (I-02).
- CodeTTL capped at 10 minutes (I-03); query-mode redirects end with #_
  (I-04, RFC 9700 §4.1.3).
- Metadata: scopes_supported, opt-in jwks_uri, endpoints and PKCE methods
  advertised only when served, REQUIRED arrays never null (I-05).
- The implicit flow refuses a subject equal to the client ID (F-08).
- D-02 and D-04 documented as deliberate.

Breaking changes and migration steps: MIGRATION.md.

Audit: F-03, F-04, F-08, I-01, I-02, I-03, I-04, I-05, D-02, D-04.

141 of 141 new or added lines in 9 files covered. (100.0%)

14830 of 15044 relevant lines covered (98.58%)

5220.28 hits per line