hyperscale-stack / security
99%
master: 98%

LAST BUILD BRANCH: dependabot/go_modules/github.com/chromedp/cdproto-0.158.4
DEFAULT BRANCH: master
Repo Added
Token eXsCYvUeMzR6iIXtqrlWZXFVqTZ43wOX2 regen
Build 259 Last
Files 224
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/audit2-jwt
branch: fix/audit2-jwt
CHANGE BRANCH
x
Sync Branches

coverage: 98.502% (+0.005%) from 98.497%
39651086061

Pull #127

github

euskadi31 
fix(jwt): close the code-review findings of the audit fixes

- The active-token check kept its error's chain under ErrTokenInactive:
  an error wrapping security.ErrInvalidRequest made the transports answer
  400 invalid_request instead of the documented 401 invalid_token. Only the
  error's text is kept now, in both the inactive and the unavailable
  mapping.
- The check received the verified claims themselves, read afterwards for
  the principal, the name and the authorities: a check rewriting them
  changed the authenticated identity. It receives a deep copy, and its
  godoc says it is called concurrently.
- An Ed25519 private key whose public half is not the one its seed derives
  (the all-zero buffer, whose half is a small-order point; spliced keys)
  passed PrivateKey.Validate and NewSigner and signed tokens no key
  verifies (RFC 8032 §5.1.5). It is refused with ErrInvalidKey.
- The opaque PS* self-check now says the signature does not verify under
  the signer's public key with a hash-size salt, which also covers a
  public key that is not the signer's.
- Tests pin that an oversized JOSE header is refused before it is
  base64-decoded, and that a token-family revocation reaches the
  active-token check through the store recipe.
- Docs: PublicKey.Validate checks a canonical y-coordinate (an off-curve
  one verifies nothing); the MIGRATION recipe uses a checked type
  assertion; tokens without client_id never report SubjectIsClient.

Audit: D-03, F-08, I-11, I-12, I-13.
Pull Request #127: fix(jwt)!: close the jwt findings of the 2026-10-21 security audit

135 of 135 new or added lines in 9 files covered. (100.0%)

1 existing line in 1 file now uncovered.

14009 of 14222 relevant lines covered (98.5%)

5363.63 hits per line

Relevant lines Covered
14222 RELEVANT LINES 14009 COVERED LINES
5363.63 HITS PER LINE
Source Files on fix/audit2-jwt

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
39651086061 fix/audit2-jwt fix(jwt): close the code-review findings of the audit fixes - The active-token check kept its error's chain under ErrTokenInactive: an error wrapping security.ErrInvalidRequest made the transports answer 400 invalid_request instead of the doc... Pull #127 euskadi31 github
98.5
39587237059 fix/audit2-jwt fix(jwt): close the code-review findings of the audit fixes - The active-token check kept its error's chain under ErrTokenInactive: an error wrapping security.ErrInvalidRequest made the transports answer 400 invalid_request instead of the doc... Pull #127 euskadi31 github
98.5
See All Builds (259)

Badge your Repo: security

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh