dkam/clinch
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

OIDC: IPv6 loopback DCR, dedup error redirects + scope labels

Browse Source 
Security-review follow-ups on the OIDC flows.

IPv6 loopback redirect_uri in dynamic client registration (RFC 8252):
- valid_redirect_uri? compared URI#host, which returns the bracketed "[::1]"
  for IPv6 literals, so http://[::1]:PORT/... was always rejected. Compare
  #hostname (unbracketed) instead, unblocking IPv6-only native clients.

Extract redirect_authorize_error (removes 12 copies of the boilerplate):
- The authorize/consent flows built the error redirect by hand ~a dozen times
  (error_uri = "...?error=..."; += "&error_description=#{CGI.escape ...}"; +=
  state; redirect_to). One helper now composes the query, and — unlike every
  copy — appends "&error=..." when the redirect_uri already has a query string
  instead of a malformed second "?".

Extract token-endpoint helpers (removes ~80 duplicated lines):
- authenticate_token_client: the identical client-auth preamble shared by the
  authorization-code, refresh, and device-code grants.
- render_token_triple: the access + refresh + id_token mint and RFC 6749 §5.1
  response shared by the authorization-code and device-code grants.

Single source of truth for scope descriptions:
- New OidcHelper#scope_description + shared shared/_scope_list partial, used by
  both the browser consent screen and the device authorization screen; drops the
  scope_labels hash and the hard-coded per-scope blocks that would have drifted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie
This commit is contained in:
Dan Milne
2026-07-19 14:14:44 +10:00
co-authored by Claude Opus 4.8
parent 79a7524fda
commit f65f8da2e7
9 changed files with 118 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/oidc_registration_controller.rb
+3 -1
View File
@@ -120,7 +120,9 @@ class OidcRegistrationController < ApplicationController
parsed = URI.parse(uri)
return false unless parsed.is_a?(URI::HTTP) # covers HTTP and HTTPS
return true if parsed.scheme == "https"
%w[localhost 127.0.0.1 ::1].include?(parsed.host)
# #hostname (not #host) returns the unbracketed form for IPv6 literals, so the
# RFC 8252 IPv6 loopback http://[::1]:PORT/... compares as "::1", not "[::1]".
%w[localhost 127.0.0.1 ::1].include?(parsed.hostname)
rescue URI::InvalidURIError
false
end