rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden CIMD client resolution and caching

Browse Source 
Tighten redirect URI validation for metadata documents, honor
Cache-Control no-store when caching fetched documents, and resolve
clients on the same transaction as authorization. Load
external_client_id from the database and parse unbounded max-stale
directives in cachecontrol.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-19 16:51:30 +02:00
parent 5b0d3e5052
commit d7e23fd890
7 changed files with 257 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/coredata/oauth2_client.go
View File

@@ -136,6 +136,7 @@ func (c *OAuth2Client) LoadByID(
q := `
SELECT
id,
COALESCE(external_client_id, '') AS external_client_id,
organization_id,
client_secret_hash,
client_name,
@@ -190,6 +191,7 @@ func (c *OAuth2Client) LoadByExternalClientID(
q := `
SELECT
id,
COALESCE(external_client_id, '') AS external_client_id,
organization_id,
client_secret_hash,
client_name,
@@ -242,6 +244,7 @@ func (c *OAuth2Clients) LoadByOrganizationID(
q := `
SELECT
id,
COALESCE(external_client_id, '') AS external_client_id,
organization_id,
client_secret_hash,
client_name,