Out of office: jcoffey-dev is traveling from November 1 to November 6. Responses to issues may be slow or delayed during this time, but I will be checking in.
The discovery document, the JWKS, user info answers and their error text
were read whole, so a provider that misbehaved, or anyone able to answer
in its place, could make the server hold any amount of memory per sign-in.
Each is now read up to 1 MiB (introspection answers too), checking the
announced length first and counting as it reads; anything larger is a
provider error.
A JWT without a kid was tried against the cached keys only, so once the
provider rotated its key every such token failed until a restart or
reload. When no cached key verifies its signature, the keys are now
fetched again once, at most once every 300 seconds as for an unknown
kid; a failed fetch waits out the interval too, so tokens can't make the
server hammer a provider that is down.
Test: on main a user info answer over 1 MiB signed in (unit test: "user
info"), and a kid-less token signed with a rotated-in key was refused
(unit test: left None, right Some("[email protected]")). Now user info,
introspection and JWKS answers over 1 MiB are refused, the kid-less
token signs in after one fetch, and a forged one right after doesn't
fetch again (unit tests with a local provider).
jcoffey-dev
c53936d05f