hyperscale-stack / security
95%
master: 98%

LAST BUILD BRANCH: dependabot/go_modules/github.com/chromedp/cdproto-0.158.4
DEFAULT BRANCH: master
Repo Added
Token eXsCYvUeMzR6iIXtqrlWZXFVqTZ43wOX2 regen
Build 259 Last
Files 224
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH feature/80-oauth2-code-replay-revocation
branch: feature/80-oauth2-code-replay-revocation
CHANGE BRANCH
x
Sync Branches

coverage: 94.768% (+0.3%) from 94.444%
38016983323

Pull #93

github

euskadi31 
test(oauth2): pin the replay wire answer and tighten the code-replay contract

Review follow-ups for the authorization-code replay revocation.

An unproven replay — another client, a missing, wrong or malformed
verifier, another redirect_uri, an expired code, a client no longer
allowed the grant — now has its answer pinned to the bare
ErrCodeAlreadyUsed ("authorization code already consumed"), the answer
of any replay and of an unknown code, so the response tells nothing
about which check failed. The former pins only checked the invalid_grant
code, which a grant returning the validation error would have passed.
The revocation a replay triggers is now checked to be bounded by the
detached revocation timeout, not only detached from the request, and
the replay guard also refuses a typed-nil CodeReplayError, which used to
panic.

The storage contract now says that a given CodeHash is saved at most
once — the Redis store overwrites, so a consumed code saved again
becomes redeemable again — and that a decorator of
ConsumeAuthorizationCode returns the store's error unchanged or wrapped
with %w, since normalizing it to ErrCodeAlreadyUsed silently disables
replay revocation. The docs describe both outcomes of a replay racing
the first exchange — it fails that exchange or revokes its tokens — say
that a late replay is refused like any replay, and cite RFC 9700
§4.2.4. The Redis comments explain what the null-flag test checks and
the non-string script reply, and the test doubles lose their dead
nolint directives. Refs #80.
Pull Request #93: fix(oauth2): revoke tokens issued from a replayed authorization code

230 of 236 new or added lines in 11 files covered. (97.46%)

4836 of 5103 relevant lines covered (94.77%)

75.68 hits per line

Relevant lines Covered
5103 RELEVANT LINES 4836 COVERED LINES
75.68 HITS PER LINE
Source Files on feature/80-oauth2-code-replay-revocation

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
38016983323 feature/80-oauth2-code-replay-revocation test(oauth2): pin the replay wire answer and tighten the code-replay contract Review follow-ups for the authorization-code replay revocation. An unproven replay — another client, a missing, wrong or malformed verifier, another redirect_uri, an e... Pull #93 euskadi31 github
94.77
See All Builds (259)

Badge your Repo: security

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh