mindersec / minder / 40931402014

65%

Build Type

push

github

Committed by web-flow

Commit Message

Fix concurrent first use of dynamic JWT validator (#6987)

The dynamic validator wrote to its allowedCerts map in getKeySet while
httprc read it through IsAllowed, with no locking. Concurrent first
requests could crash the server with "concurrent map writes".

Concurrent first requests for the same issuer could also be rejected
with "resource already exists" or "is not ready", because several
callers passed the IsRegistered check before any of them finished
Register. The discovery doc was also fetched on every validation.

Cache each allowed issuer's JWKS URL after discovery, and use
singleflight so concurrent callers for an issuer share one discovery
and registration. Nothing is cached on failure, so the next request
retries. The cache is only written after the allowedIssuers check, so
it stays bounded.

Guard allowedCerts and the issuer cache with separate locks, neither
held across Register (which calls IsAllowed). Switch Validator to
pointer receivers and pass a pointer to httprc.WithWhitelist so the
locks are not copied.

Fixes #6955
Fixes #6956

Signed-off-by: Nayem Ahmed <nym010203@gmail.com>

Coverage Stats

29 of 29 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

22946 of 35441 relevant lines covered (64.74%)

58.36 hits per line