mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-08-07 11:55:27 +00:00
9e6e8b62d3
Fixes 11 security/robustness issues identified across a 4-model review (deepseek, gpt-5.5, claude-fable-5, gpt-5.6-sol) of the OIDC SSO implementation: UserInfo & claims integrity: - Require non-empty matching sub before trusting UserInfo (P2) - Reject non-dict/malformed UserInfo responses as unavailable - Validate NumericDate strictly: reject bool, NaN, Inf - Add iat future-token verification (60s tolerance) - Initialize userinfo safely before try block Callback hardening: - Clear CSRF cookie on ALL 8 failure branches + 503 unconfigured - Echo state parameter on IdP error redirects (OIDC Core §3.1.2.6) - Check create_session_trusted() return value before setting cookie Defense-in-depth: - OIDC_MAX_AGE env var with auth_time verification (+60s skew) - AuthManager.check_oidc_totp() with disk-reloaded TOTP enforcement - SameSite=Lax proxy documentation in .env.example UI fix: - Preserve OIDC callback error after setMode() initialization Tests: 164 passed (123 OIDC + 41 regression), +21 new regression tests |
||
|---|---|---|
| .. | ||
| fonts | ||
| icons | ||
| js | ||
| lib | ||
| app.js | ||
| icon.ico | ||
| index.html | ||
| login.html | ||
| manifest.json | ||
| modal-control-variants.html | ||
| style.css | ||
| sw.js | ||
| wave-variants.html | ||
| whirlpool-variants.html | ||