stacklok / toolhive / 41342839142

73%

Build Type

push

github

Committed by web-flow

Commit Message

Move authserver JWK parsing to go-jose v4 (#7012)

* Move authserver JWK parsing to go-jose v4

go-jose v3 validates RSA keys embedded in JWKs without bounding their
size (GHSA-mgcc-cww5-fp2q) and has no patched release. Parse keys with
go-jose v4.1.6 everywhere ToolHive owns the parsing, copying parsed keys
field by field into the v3 types fosite v0.49.0 still requires.

fosite itself parses client assertions and OIDC request objects with v3
before looking up a client, so refuse any such JWT whose header embeds
a jwk, or that is not a compact JWS, before fosite sees it. fosite never
uses an embedded key, so conforming clients are unaffected.

Raise go-jose's new 4096-bit RSA parse limit to our existing 8192-bit
policy so registered clients keep loading, and decode a stored Redis
key set separately so one that go-jose rejects still answers
invalid_client instead of failing the whole row.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Check request objects before client lookup

Rejecting an unsafe request object after the back-channel-only client
check answered differently for configured and unknown clients, which
revealed whether a back-channel client exists. The check does not depend
on the client, so it now runs first.

Also pin that go-jose's RSA parse limit matches MaxRSAKeyBits, so client
keys above go-jose's 4096-bit default keep decoding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

118 of 122 new or added lines in 9 files covered. (96.72%)

3 existing lines in 1 file now uncovered.

91751 of 126894 relevant lines covered (72.31%)

133.06 hits per line