Dave Kempe 54c1d5be17 Security hardening: open redirect, cookie flags, constant-time auth, fuzz targets ...

- Fix open redirect via protocol-relative URLs (//evil.com) in OIDC next parameter
- Add Secure flag to all cookie-clearing Set-Cookie headers
- Add single-quote escaping to html_escape() (defence-in-depth)
- Cross-check OIDC state cookie against state query parameter in callback
- Switch API key and user token validation to constant-time hash comparison (subtle)
- Add 3 new fuzz targets: api_input, vault_response, websocket_message
- Bump version to 0.3.3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-12 08:42:33 +11:00

..

fuzz_targets

Security hardening: open redirect, cookie flags, constant-time auth, fuzz targets

2026-02-12 08:42:33 +11:00

.gitignore

Add fuzz testing infrastructure and fix UTF-8 boundary panic

2026-02-07 13:39:16 +11:00

Cargo.lock

Security hardening: open redirect, cookie flags, constant-time auth, fuzz targets

2026-02-12 08:42:33 +11:00

Cargo.toml

Security hardening: open redirect, cookie flags, constant-time auth, fuzz targets

2026-02-12 08:42:33 +11:00

FINDINGS.md

Add guacd parser fuzz harness and document fuzzing findings

2026-02-07 14:17:42 +11:00