tinyauth

mirror of https://github.com/steveiliop56/tinyauth.git synced 2025-12-31 04:22:28 +00:00

Files

Olivier Dumont ad12110fbf Replace SHA256 with HKDF for key derivation and fix scope validation

Security improvements:

1. HKDF key derivation:
   - Replace raw sha256.Sum256() with proper HKDF (HMAC-based KDF)
   - Uses domain-separated label 'oidc-aes-256-key-v1' for key derivation
   - Applied to both encryptPrivateKey and decryptPrivateKey
   - Provides better security properties than raw hash

2. Scope validation fix:
   - Only add 'openid' scope if it's both requested AND in client's
     allowedScopes
   - Prevents bypassing client scope restrictions
   - Respects configured allowedScopes

Both changes improve security posture while maintaining backward
compatibility.

2025-12-30 13:37:43 +01:00