mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-05 15:17:56 +00:00
9215195631
Two fixes from review feedback: 1. (security/availability) Record _last_jwks_refresh timestamp BEFORE calling _refresh_jwks() so a failed JWKS fetch is also throttled by the 60-second cooldown. Previously the timestamp was only set after success, so an outage or key rotation would retry the IdP on every login attempt. 2. (auth) Use the shared persistent app key from secret_storage (_get_fernet) for OIDC state encryption instead of reading data/.app_key directly and falling back to a per-process key. This guarantees all uvicorn workers share the same Fernet key, even on a fresh data directory — worker A's state is always decryptable by worker B on the callback. Add regression tests for both fixes. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| atomic_io.py | ||
| auth.py | ||
| constants.py | ||
| database.py | ||
| exceptions.py | ||
| log_safety.py | ||
| middleware.py | ||
| models.py | ||
| oidc.py | ||
| platform_compat.py | ||
| session_manager.py | ||