Dan MilneandClaude Opus 4.8
71ee301dd2
More device-flow security-review fixes. Replay-revocation on device_code redemption (was: destroy on use): - Redemption now marks the code redeemed_at and links the issued access/refresh tokens back to it (new oidc_device_code_id FKs, on_delete: :nullify) instead of destroying the row. A replayed redeemed code is detected as reuse — revoking every descended token and returning a distinguishable "already been used" invalid_grant rather than the generic "Invalid device_code" — mirroring the authorization-code reuse semantics (RFC 6749 §4.1.2). The device_code FK is carried forward across refresh rotation so revocation reaches the whole chain. Redeemed codes are reaped by the existing expiry cleanup sweep. user_code CSPRNG (RFC 8628 §6.1): - The 8-char user_code is a credential (type it + Approve mints tokens), so draw it from SecureRandom instead of Ruby's global Mersenne Twister (Array#sample). Rate-limit the /device verification endpoint (RFC 8628 §5.1): - Add the app's standard 10/min limit on show + verify so a signed-in user can't brute-force the short code space to deny or hijack a pending authorization. Also carried in this commit (other agent's working-tree change): - Give each OidcController rate_limit a distinct name: so frequent device polling on the token endpoint no longer shares one counter with (and 429s) unrelated token/refresh/revoke/introspect calls. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie
90 lines
2.7 KiB
Ruby
90 lines
2.7 KiB
Ruby
class OidcRefreshToken < ApplicationRecord
|
|
belongs_to :application
|
|
belongs_to :user
|
|
belongs_to :oidc_access_token
|
|
belongs_to :oidc_authorization_code, optional: true
|
|
belongs_to :oidc_device_code, optional: true
|
|
|
|
before_validation :generate_token, on: :create
|
|
before_validation :set_expiry, on: :create
|
|
before_validation :set_token_family_id, on: :create
|
|
|
|
validates :token_hmac, presence: true, uniqueness: true
|
|
|
|
scope :valid, -> { where("expires_at > ?", Time.current).where(revoked_at: nil) }
|
|
scope :expired, -> { where("expires_at <= ?", Time.current) }
|
|
scope :revoked, -> { where.not(revoked_at: nil) }
|
|
scope :active, -> { valid }
|
|
|
|
# For token rotation detection (prevents reuse attacks)
|
|
scope :in_family, ->(family_id) { where(token_family_id: family_id) }
|
|
|
|
attr_accessor :token # Store plaintext token temporarily for returning to client
|
|
|
|
# Find refresh token by plaintext token using HMAC verification
|
|
def self.find_by_token(plaintext_token)
|
|
return nil if plaintext_token.blank?
|
|
|
|
token_hmac = compute_token_hmac(plaintext_token)
|
|
find_by(token_hmac: token_hmac)
|
|
end
|
|
|
|
# Compute HMAC for token lookup
|
|
def self.compute_token_hmac(plaintext_token)
|
|
OpenSSL::HMAC.hexdigest("SHA256", TokenHmac::KEY, plaintext_token)
|
|
end
|
|
|
|
def expired?
|
|
expires_at <= Time.current
|
|
end
|
|
|
|
def revoked?
|
|
revoked_at.present?
|
|
end
|
|
|
|
def active?
|
|
!expired? && !revoked?
|
|
end
|
|
|
|
def revoke!
|
|
update!(revoked_at: Time.current)
|
|
end
|
|
|
|
# Revoke all refresh tokens in the same family (token rotation security).
|
|
# Also revoke every access token issued within the family: on a detected reuse
|
|
# attack the stolen chain's access tokens must not remain usable at /userinfo
|
|
# until they expire.
|
|
def revoke_family!
|
|
return unless token_family_id.present?
|
|
|
|
now = Time.current
|
|
family = OidcRefreshToken.in_family(token_family_id)
|
|
access_token_ids = family.pluck(:oidc_access_token_id).compact.uniq
|
|
|
|
family.update_all(revoked_at: now)
|
|
if access_token_ids.any?
|
|
OidcAccessToken.where(id: access_token_ids, revoked_at: nil).update_all(revoked_at: now)
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def generate_token
|
|
# Generate random plaintext token
|
|
self.token ||= SecureRandom.urlsafe_base64(48)
|
|
# Store HMAC in database (not plaintext)
|
|
self.token_hmac ||= self.class.compute_token_hmac(token)
|
|
end
|
|
|
|
def set_expiry
|
|
# Use application's configured refresh token TTL
|
|
self.expires_at ||= application.refresh_token_expiry
|
|
end
|
|
|
|
def set_token_family_id
|
|
# Use a random ID to group tokens in the same rotation chain
|
|
# This helps detect token reuse attacks
|
|
self.token_family_id ||= SecureRandom.random_number(2**31)
|
|
end
|
|
end
|