mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:01:30 +00:00
shankar0123
15435ca02b
Closes HIGH-3 of the 2026-05-10 audit. Pre-fix the BCL handler
accepted any logout_token whose iat + jti were syntactically present
but never checked (a) that iat fell within a skew window or (b) that
jti hadn't been seen before. A captured logout_token was replayable
indefinitely; once CRIT-2 was fixed, every replay would revoke the
user's current sessions — persistent DoS. RFC 9700 §2.7 + OIDC BCL
1.0 §2.5 require jti replay defense.
- Migration 000040_bcl_replay_cache: oidc_bcl_consumed_jtis table with
composite PK on (jti, issuer_url) — RFC 7519 §4.1.7 per-issuer
uniqueness — and an expires_at index for the GC sweep.
- repository.BCLReplayRepository interface + ErrBCLJTIAlreadyConsumed
sentinel. Postgres impl uses INSERT...ON CONFLICT DO NOTHING
RETURNING true for atomic single-use semantics in one round-trip.
- handler.DefaultBCLVerifier gains WithMaxAge + nowFn clock seam. iat
freshness check rejects tokens whose iat is in the future beyond
max-age OR stale beyond it. Verifier signature extended:
Verify(ctx, jwt) (iss, sub, sid, jti string, iat int64, err error).
- handler.AuthSessionOIDCHandler gains BCLReplayConsumer (interface)
+ WithBCLReplayConsumer(consumer, maxAge) setter. BackChannelLogout
consumes the jti post-verify with TTL = max(24h, 2*maxAge):
- first-receive → 200, sessions revoked, audit outcome=revoked
- replay (ErrBCLJTIAlreadyConsumed) → 200 + Cache-Control: no-store,
audit outcome=jti_replayed, sessions NOT re-revoked
- transient (non-AlreadyConsumed error) → 503 so the IdP retries
- internal/scheduler/scheduler.go: SetBCLReplayGarbageCollector wires
SweepExpired into the existing session-GC tick (no separate ticker
for short-lived replay rows).
- cmd/server/main.go: bclMaxAge from cfg.Auth.OIDCBCLMaxAgeSeconds
(default 60s, env CERTCTL_OIDC_BCL_MAX_AGE_SECONDS); bclReplayRepo
wired into the verifier + handler + scheduler.
- Three regression tests in internal/api/handler/bcl_replay_test.go:
TestBackChannelLogout_FirstReceiveConsumesJTI,
TestBackChannelLogout_ReplayedJTIReturns200WithAudit,
TestBackChannelLogout_TransientConsumeFailureReturns503.
- internal/api/handler/auth_session_oidc_test.go: stubBCLVerifier
gains jti + iat fields; existing TestBackChannelLogout_* tests
rewritten for the new Verify return.
Verification gate green: gofmt clean, go vet clean, go test -short
-count=1 on internal/api/handler / internal/api/router /
internal/scheduler / cmd/server / internal/auth/oidc /
internal/auth/breakglass — all pass.
CRIT-1..CRIT-5 + HIGH-1 + HIGH-2 + HIGH-3 of the 2026-05-10 audit
now closed on this branch. Spec at
cowork/auth-bundles-fixes-2026-05-10/07-high-3-bcl-replay-defense.md.
Refs: cowork/auth-bundles-audit-2026-05-10.md HIGH-3
31 lines
1.3 KiB
Go
31 lines
1.3 KiB
Go
package repository
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"time"
|
|
)
|
|
|
|
// ErrBCLJTIAlreadyConsumed is returned by BCLReplayRepository.ConsumeJTI
|
|
// when the (jti, issuer_url) pair has already been recorded. The
|
|
// handler maps this to OIDC BCL 1.0 §2.7 "still 200 + Cache-Control:
|
|
// no-store" with audit outcome=jti_replayed.
|
|
var ErrBCLJTIAlreadyConsumed = errors.New("oidc/bcl: jti already consumed for this issuer")
|
|
|
|
// BCLReplayRepository tracks the consumed-jti set used by the BCL
|
|
// logout-token replay defense. Audit 2026-05-10 HIGH-3 closure. Backed
|
|
// by the oidc_bcl_consumed_jtis table (migration 000040).
|
|
type BCLReplayRepository interface {
|
|
// ConsumeJTI atomically records that a (jti, issuer_url) pair has
|
|
// been consumed. The row's expires_at is set to now + ttl. Returns
|
|
// ErrBCLJTIAlreadyConsumed when the pair was already recorded
|
|
// (single-use semantics via INSERT...ON CONFLICT DO NOTHING).
|
|
// Other errors (DB hiccup, connection reset) are transient — the
|
|
// handler returns 503 so the IdP retries.
|
|
ConsumeJTI(ctx context.Context, jti, issuerURL string, ttl time.Duration) error
|
|
|
|
// SweepExpired removes rows whose expires_at is in the past.
|
|
// Returns count deleted. Called from the scheduler GC loop.
|
|
SweepExpired(ctx context.Context, now time.Time) (int, error)
|
|
}
|