46ae65f4d2
Move the 'remove_query_param' to the application controller
Dan Milne2026-01-05 13:03:03 +11:00
95d0d844e9
Add a method to remove parameters from urls, so we can redirect without risk of infinite redirect. Fix a bunch of redirects to login afer being foced to log out. Add missing migrations
Dan Milne2026-01-05 13:01:32 +11:00
524a7719c3
Merge branch 'main' into feature/claims
Dan Milne2026-01-05 12:11:53 +11:00
8110d547dd
Fix bug with session deletion when logout forced and we have a redirect to follow
Dan Milne2026-01-05 12:11:52 +11:00
25e1043312
Add skip-consent, correctly use 303, rather than 302, actually rename per app 'logout' to 'require re-auth'. Add helper methods for token lifetime - allowing 10d for 10days for example.
Dan Milne2026-01-05 12:03:01 +11:00
074a734c0c
Accidentally added skip-consent to this branch
Dan Milne2026-01-05 12:01:04 +11:00
f4a697ae9b
More OpenID Conformance test fixes - work with POST, correct auth code character set, correct no-store cache headers
Dan Milne2026-01-03 12:28:43 +11:00
0bb84f08d6
OpenID conformance test: we get a warning for not having a value for every claim. But we can explictly list support claims. Nothing we can do about a warning in the complience.
2026.01
Dan Milne2026-01-02 16:35:12 +11:00
182682024d
OpenID Conformance: Include all required scopes when profile is requested, even if they're empty
Dan Milne2026-01-02 15:47:40 +11:00
b517ebe809
OpenID conformance test: Allow posting the access token in the body for userinfo endpoint
Dan Milne2026-01-02 15:41:07 +11:00
c03034c49f
Add files to support brakeman and standardrb. Fix some SRB warnings
Dan Milne2026-01-01 13:18:30 +11:00
9234904e47
Add security-todo and beta-checklists, and some security rake tasks
Dan Milne2026-01-01 13:06:54 +11:00
e36a9a781a
Add new claims to the discovery endpoint
Dan Milne2025-12-31 17:27:28 +11:00
d036e25fef
Add auth_time, acr and azp support for OIDC claims
Dan Milne2025-12-31 17:07:54 +11:00
fcdd2b6de7
Continue adding auth_time - need it in the refresh token too, so we can accurately create new access tokens.
Dan Milne2025-12-31 16:57:28 +11:00
3939ea773f
We already have a login_time stored - the time stamp of the Session instance creation ( created after successful login ).
Dan Milne2025-12-31 16:45:45 +11:00
4b4afe277e
Include auth_time in ID token. Switch from upsert -> find_and_create_by so we actually get sid values for consent on the creation of the record
Dan Milne2025-12-31 16:36:32 +11:00
364e6e21dd
Fixes for tests and AR Encryption
Dan Milne2025-12-31 16:08:05 +11:00
3db466f5a2
Switch Access / Refresh tokens / Auth Code from bcrypt ( and plain ) to hmac. BCrypt is for low entropy passwords and prevents dictionary attacks - HMAC is suitable for 256-bit random data.
Dan Milne2025-12-31 15:48:32 +11:00
7c6ae7ab7e
Store only HMAC'd Auth codes, rather than plain text auth codes.
Dan Milne2025-12-31 15:00:00 +11:00
ed7ceedef5
Include the hash of the access token in the JWT / ID Token under the key at_hash as per the requirements. Update the discovery endpoint to describe subject_type as 'pairwise', rather than 'public', since we do pairwise subject ids.
Dan Milne2025-12-31 14:45:38 +11:00
40815d3576
Use SolidQueue in production. Use the find_by_token method, rather than iterating over refresh tokens, as we already fixed for tokens
Dan Milne2025-12-31 14:32:34 +11:00
bb5aa2e6d6
Add rails encryption for totp - allow configuration of encryption secrets from env, or derive them from SECRET_KEY_BASE. Don't leak email address via web_authn, rate limit web_authn, escape oidc state value, require password for changing email address, allow settings the hmac secret for token prefix generation
Dan Milne2025-12-31 10:33:56 +11:00
cc7beba9de
PKCE is now default enabled. You can now create public / no-secret apps OIDC apps
Dan Milne2025-12-31 09:22:18 +11:00
00eca6d8b2
Default deny forward_auth requests
Dan Milne2025-12-30 16:04:01 +11:00
71d59e7367
Remove plain text token from everywhere
Dan Milne2025-12-30 11:58:11 +11:00
99c3ac905f
Add a token prefix column, generate the token_prefix and the token_digest, removing the plaintext token from use.
Dan Milne2025-12-30 09:45:16 +11:00
0761c424c1
Fix tests. Remove tests which test rails functionality
Dan Milne2025-12-30 00:18:19 +11:00
2a32d75895
Fix tests - don't test standard rails features
Dan Milne2025-12-29 19:45:01 +11:00
7796c38c08
Add pairwise SID with a UUIDv4, a significatant upgrade over User.id.to_s. Complete allowing admin to enforce TOTP per user
Dan Milne2025-11-23 11:16:06 +11:00
1ee3302319
Improvements derived from rodauth-oauth
Dan Milne2025-11-12 22:17:55 +11:00
67f28faaca
Improve some front end views. More descriptive error condition reporting. Updates to CLINCH_HOST for better WEBAUTHN
Dan Milne2025-11-12 16:24:05 +11:00
fb14ce032f
Strip out more inline javascript code. Encrypt backup codes and treat the backup codes attribute as a json array
Dan Milne2025-11-04 18:46:11 +11:00
Dan Milne