lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-11-03 07:44:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): scope introspection cache keys to the middleware instance

Browse Source 
The introspection cache used the raw token as key in a shared cache.
Two instances with different providers or clients shared results. Keys
now use the same instance prefix as the verified-token cache.
This commit is contained in:
lukaszraczylo
2026-11-03 01:18:12 +00:00
parent 6e522fd212
commit 2f0ee00e51
4 changed files with 34 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
token_cache_namespace_test.go
+13
View File
@@ -54,3 +54,16 @@ func TestTokenCacheEmptyNamespaceKeepsLegacyKey(t *testing.T) {
t.Fatal("namespace-less caches must keep sharing the legacy key")
}
}
func TestIntrospectionKeyScopedPerInstance(t *testing.T) {
a := &TraefikOidc{tokenCache: &TokenCache{}}
b := &TraefikOidc{tokenCache: &TokenCache{}}
a.tokenCache.SetNamespace("p|app-a|app-a")
b.tokenCache.SetNamespace("p|app-b|app-b")
if a.introspectionKey("tok") == b.introspectionKey("tok") {
t.Fatal("different instances share an introspection cache key")
}
if got := (&TraefikOidc{}).introspectionKey("tok"); got != "tok" {
t.Fatalf("namespace-less key = %q, want raw token", got)
}
}