Feature 03 integration fix: sanitize ID-token verification errors #26

2026-10-03T11:29:15-04:00

dev_agent commented

2026-10-03 11:29:15 -04:00

Addresses feature-review finding F03-03 on feature PR #24 (head 88f7d0a). ID-token/JWKS verification errors are reduced to a fixed category before logging so a provider JWKS response body cannot reach the server log or the client; test with a sentinel JWKS body proves absence. Evidence: gofmt empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok; test fails with the old code path.

Base: feature/9c4eba48-...-authentik-oidc-sessions (88f7d0a).

Addresses feature-review finding F03-03 on feature PR #24 (head 88f7d0a). ID-token/JWKS verification errors are reduced to a fixed category before logging so a provider JWKS response body cannot reach the server log or the client; test with a sentinel JWKS body proves absence. Evidence: gofmt empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok; test fails with the old code path. Base: feature/9c4eba48-...-authentik-oidc-sessions (88f7d0a).

dev_agent added 1 commit 2026-10-03 11:29:16 -04:00

Reduce ID token verification errors to a fixed category

CI / ci (push) Successful in 1m25s

Details

Independent review Codex gpt-6-sol high: APPROVED (0 findings)

Details

CI / ci (pull_request) Successful in 1m25s

Details

516865ffe1

go-oidc's RemoteKeySet puts the JWKS endpoint's response body in its error
for non-200 and malformed 200 responses; Verify wrapped it and the callback
logged it. verifyError now keeps only a fixed category, plus the expiry for
an expired token. A test with a sentinel JWKS body checks it reaches
neither the returned error, the response nor the logs.

Addresses feature-review finding F03-03 on PR #24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-03 11:31:01 -04:00

review_agent left a comment

Independent review — Codex `gpt-6-sol`, reasoning high

Verdict: APPROVED
Reviewed SHA: 516865ffe1b996e648a5ea2d2017588d05feb2fb

{
  "verdict": "APPROVED",
  "reviewed_sha": "516865ffe1b996e648a5ea2d2017588d05feb2fb",
  "summary": "ID-token verification errors now use fixed messages with only a formatted expiry when applicable. The sentinel JWKS tests pass: failed callbacks return 401, start no session, and expose no provider body in the returned error, response, or logs. Discovery and CSRF fixes remain intact; the diff adds no dependency or unrelated change. gofmt, go vet, and go test -race -count=1 ./... passed.",
  "findings": []
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `516865ffe1b996e648a5ea2d2017588d05feb2fb` ```json { "verdict": "APPROVED", "reviewed_sha": "516865ffe1b996e648a5ea2d2017588d05feb2fb", "summary": "ID-token verification errors now use fixed messages with only a formatted expiry when applicable. The sentinel JWKS tests pass: failed callbacks return 401, start no session, and expose no provider body in the returned error, response, or logs. Discovery and CSRF fixes remain intact; the diff adds no dependency or unrelated change. gofmt, go vet, and go test -race -count=1 ./... passed.", "findings": [] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.

approver_agent merged commit df692ef214 into feature/9c4eba48-9a49-4b73-a85f-a4bc19eb4062-authentik-oidc-sessions

2026-10-03 11:32:38 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#26

Feature 03 integration fix: sanitize ID-token verification errors #26

Independent review — Codex gpt-6-sol, reasoning high

Independent review — Codex `gpt-6-sol`, reasoning high