Olivier Dumont 1b37096b58 CRITICAL: Add replay protection for authorization codes ...

Authorization codes were implemented as stateless JWTs with no tracking,
allowing the same code to be exchanged for tokens multiple times. This
violates OAuth 2.0 RFC 6749 Section 4.1.2 which mandates that authorization
codes MUST be single-use.

This change:
- Adds oidc_authorization_codes table to track code usage
- Stores authorization codes in database when generated
- Validates code exists and hasn't been used before exchange
- Marks code as used immediately after validation
- Prevents replay attacks where intercepted codes could be reused

Security impact:
- Prevents attackers from reusing intercepted authorization codes
- Ensures compliance with OAuth 2.0 security requirements
- Adds database-backed single-use enforcement

2025-12-30 13:00:19 +01:00

..

migrations

CRITICAL: Add replay protection for authorization codes

2025-12-30 13:00:19 +01:00

assets.go

feat: add sqlite database for storing sessions (#326)

2025-08-29 12:35:11 +03:00