hyperscale-stack / security

98%

master: 98%

LAST BUILD ON BRANCH fix/audit-oauth2-endpoints

branch: fix/audit-oauth2-endpoints

CHANGE BRANCH

x

Reset

Sync Branches

• fix/audit-oauth2-endpoints
• ci/real-db-stores
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/checkout-7
• dependabot/github_actions/actions/setup-go-7
• dependabot/github_actions/softprops/action-gh-release-3
• dependabot/go_modules/connectrpc.com/connect-1.21.0
• dependabot/go_modules/connectrpc.com/connect-1.21.1
• dependabot/go_modules/connectrpc.com/grpchealth-1.5.0
• dependabot/go_modules/github.com/alicebob/miniredis/v2-2.39.0
• dependabot/go_modules/github.com/alicebob/miniredis/v2-2.40.0
• dependabot/go_modules/github.com/chromedp/cdproto-0.157.9
• dependabot/go_modules/github.com/chromedp/cdproto-0.158.0
• dependabot/go_modules/github.com/chromedp/cdproto-0.158.4
• dependabot/go_modules/github.com/chromedp/chromedp-0.20.1
• dependabot/go_modules/github.com/chromedp/chromedp-0.21.0
• dependabot/go_modules/github.com/go-jose/go-jose/v4-4.1.5
• dependabot/go_modules/github.com/redis/go-redis/v9-9.19.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.20.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.20.1
• dependabot/go_modules/github.com/redis/go-redis/v9-9.21.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.22.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.23.0
• dependabot/go_modules/github.com/rs/zerolog-1.35.0
• dependabot/go_modules/github.com/rs/zerolog-1.35.1
• dependabot/go_modules/github.com/stretchr/testify-1.12.1
• dependabot/go_modules/github.com/zitadel/oidc/v3-3.51.16
• dependabot/go_modules/go.opentelemetry.io/otel-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.46.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.47.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.46.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.47.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.46.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.47.0
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/golang.org/x/crypto-0.46.0
• dependabot/go_modules/golang.org/x/crypto-0.47.0
• dependabot/go_modules/golang.org/x/crypto-0.48.0
• dependabot/go_modules/golang.org/x/crypto-0.49.0
• dependabot/go_modules/golang.org/x/crypto-0.50.0
• dependabot/go_modules/golang.org/x/crypto-0.51.0
• dependabot/go_modules/golang.org/x/crypto-0.52.0
• dependabot/go_modules/golang.org/x/crypto-0.53.0
• dependabot/go_modules/golang.org/x/crypto-0.54.0
• dependabot/go_modules/golang.org/x/crypto-0.55.0
• dependabot/go_modules/golang.org/x/crypto-0.56.0
• dependabot/go_modules/golang.org/x/crypto-0.57.0
• dependabot/go_modules/google.golang.org/grpc-1.81.1
• dependabot/go_modules/google.golang.org/grpc-1.82.0
• dependabot/go_modules/google.golang.org/grpc-1.82.1
• dependabot/go_modules/google.golang.org/grpc-1.83.0
• dependabot/go_modules/google.golang.org/grpc-1.83.1
• dependabot/go_modules/google.golang.org/grpc-1.83.2
• dependabot/go_modules/google.golang.org/grpc-1.84.0
• dependabot/go_modules/modernc.org/sqlite-1.51.0
• dependabot/go_modules/modernc.org/sqlite-1.52.0
• dependabot/go_modules/modernc.org/sqlite-1.53.0
• dependabot/go_modules/modernc.org/sqlite-1.54.0
• dependabot/go_modules/modernc.org/sqlite-1.56.0
• dependabot/go_modules/modernc.org/sqlite-1.57.0
• dependabot/go_modules/modernc.org/sqlite-1.58.0
• dependabot/go_modules/modernc.org/sqlite-1.60.1
• dependabot/go_modules/modernc.org/sqlite-1.61.0
• dependabot/go_modules/tools/osv-scanner/golang.org/x/vuln-1.9.0
• feat/audit2-attempt-limiter
• feature/63-oauth2-error-hook
• feature/64-oauth2-expires-in-clock
• feature/78-oauth2-refresh-rotation-profile
• feature/79-oauth2-pkce-syntax
• feature/80-oauth2-code-replay-revocation
• feature/81-oauth2-introspection-authz
• feature/82-oauth2-refresh-family-revocation
• feature/83-oauth2-oidc-extension-points
• feature/84-oidc-provider
• feature/85-oidc-client
• feature/86-oidc-interop
• feature/87-saml-sp
• feature/88-saml-adversarial-interop
• feature/94-oauth2-empty-client-secret
• feature/connectrpc
• feature/oauth2-server
• feature/refactoring
• fix/audit-ci-deps
• fix/audit-core-transport
• fix/audit-jwt
• fix/audit-oauth2-client-policy
• fix/audit-oidc-client
• fix/audit-oidc-provider
• fix/audit-saml-sp
• fix/audit-session-password-basic
• fix/audit-sql-stores
• fix/audit2-core
• fix/audit2-jose
• fix/audit2-jwt
• fix/audit2-oauth2-front
• fix/audit2-oidc-client
• fix/audit2-oidc-provider
• fix/audit2-saml
• fix/audit2-stores
• fix/audit2-supply-chain
• master

Build # 38359255608

Build Type

Pull #119

github

Committed by euskadi31

Commit Message

docs(oidc): scope the implicit-flow refusal to Provider.AuthorizeHandler

The docs said the OpenID Provider never serves the implicit flow, and
that its RFC 8414 metadata never advertises it. But only
Provider.AuthorizeHandler refuses AllowImplicit: a handler built from
Provider.Server().AuthorizeHandler, the path MIGRATION documents for
plain OAuth 2.0 requests approved by another ConsentFunc, still accepts
it. The server then serves the flow to those requests and advertises
it in its RFC 8414 metadata, while the discovery document does not,
which RFC 9068 §4 forbids.

The CHANGELOG, docs/oidc-provider.md, LIMITATIONS and MIGRATION
statements now apply to Provider.AuthorizeHandler. The Provider.Server
and AuthorizeHandler godoc, the provider docs, LIMITATIONS and the
MIGRATION path warn never to enable AllowImplicit on a handler built
from Server(): nothing refuses it there, and RFC 9700 §2.1.2 deprecates
the flow. No code changes, as decided (UD-1): a guard would need a new
oauth2 hook.

Audit: OAUTH-I4.

Pull Request Pull Request #119: fix(oauth2)!: harden the authorization server endpoints

Coverage Stats

394 of 394 new or added lines in 19 files covered. (100.0%)

1 existing line in 1 file now uncovered.

13313 of 13554 relevant lines covered (98.22%)

5085.55 hits per line