stacklok / toolhive / 42911895955

73%

Build Type

push

github

Committed by web-flow

Commit Message

Allow clock skew on private_key_jwt assertions (#7088)

fosite v0.49.0 checks a client assertion's exp, iat and nbf with no
margin, so a client whose clock runs a second ahead of the server's
fails with invalid_client at random. fosite has no setting for a
margin, and its only clock hook is process-wide.

fosite still validates every assertion. When it refuses one only on
its time claims, the signature, client, auth method, algorithm and
key have already passed, because fosite checks the signature first.
A wrapper then re-checks the time claims with a 60 second margin and
completes the checks fosite skipped: iss, sub, aud, the client's auth
method and the jti. Tests pin fosite's order of checks, so a fosite
upgrade that reorders them fails CI. The recovery applies only to
fosite's own strategy, because a caller-supplied one gives no such
guarantee about its order.

The time claims are judged once more after the jti is reserved. The
client lookup and the jti check can be slow, and without the last
check a consumed assertion whose replay marker expired meanwhile would
be reserved as new and accepted.

One function, ValidateClientAssertionExp, now holds the rule for exp,
and it applies to assertions fosite accepts on its own and to those the
fallback recovers. An assertion is refused unless its replay marker
would outlive it, that is exp plus 65 seconds is still in the future,
and unless exp is at most 5 minutes plus 60 seconds ahead of now. The
cap on exp ahead of now was 5 minutes and is now 5 minutes plus the
same 60 second skew as the other claims. There is no cap on exp - iat.
An assertion fosite accepts during the second named by its exp is now
accepted instead of refused. The fallback calls the function before it
reserves the jti, so a refused assertion burns no reservation. An exp
before iat is refused in the fallback.

The server decides how long each used jti is kept: until exp + 60s +
5s. The storage wrapper hands the store that deadline inste... (continued)

Coverage Stats

167 of 169 new or added lines in 6 files covered. (98.82%)

11 existing lines in 3 files now uncovered.

94114 of 129250 relevant lines covered (72.82%)

857.62 hits per line