hyperscale-stack / security / 39675729816

98%

push

github

fix(oidc/client)!: close the security audit findings of the OIDC client

Close the OIDC client findings of the security audit of 2026-10-21.

- Every secret of the API is an oidcclient.Secret (NewSecret, Reveal):
  fmt, slog and encoding/json render it REDACTED, even when reached
  through unexported fields or a dereferenced *Client (F-11).
- New refuses InsecureCookies unless RedirectURL is http on a loopback
  host, so an https deployment always keeps __Host- and Secure on the
  binding cookie (F-12, RFC 9700 §4.7).
- AuthRequest's String/GoString/Format/LogValue drop the state and the
  URL query; the leaked-state residual is documented (I-14).
- An empty Config.Algorithms means RS256 (I-16, OIDC Core §3.1.3.7).
- Config.RequireIssParameter requires and compares iss on every
  response; without it, iss from a provider that does not advertise
  RFC 9207 support is discarded (I-17, D-13, RFC 9207 §2.4).
- memory transaction store bounded by default (10 000, ErrFull, no
  eviction) (D-12); JWK Set TTL 5 minutes, Redis failover documented
  (D-14).
- PS256/384/512 ID Tokens verified with the RFC 7518 §3.5 salt length;
  non-canonical or small-order Ed25519 keys ignored, as in jwt.

Breaking changes and migration steps: MIGRATION.md.

Audit: F-11, F-12, I-14, I-16, I-17, D-12, D-13, D-14.

110 of 110 new or added lines in 14 files covered. (100.0%)

14886 of 15100 relevant lines covered (98.58%)

5170.18 hits per line