Merge pull request #24 from lukaszraczylo/additional-improvements

additional improvements

cache.go

@@ -24,13 +24,24 @@ type Cache struct {
 	// mutex protects concurrent access to the items map
 	// Use RLock/RUnlock for reads and Lock/Unlock for writes
 	mutex sync.RWMutex
+
+	// maxSize is the maximum number of items allowed in the cache
+	maxSize int
+
+	// accessList maintains the order of item access for eviction
+	accessList []string
 }
 
+// DefaultMaxSize is the default maximum number of items in the cache
+const DefaultMaxSize = 1000
+
 // NewCache creates a new empty cache instance.
 // The cache is immediately ready for use and is thread-safe.
 func NewCache() *Cache {
 	return &Cache{
-		items: make(map[string]CacheItem),
+		items:      make(map[string]CacheItem),
+		maxSize:    DefaultMaxSize,
+		accessList: make([]string, 0, DefaultMaxSize),
 	}
 }
 
@@ -43,10 +54,27 @@ func NewCache() *Cache {
 func (c *Cache) Set(key string, value interface{}, expiration time.Duration) {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
+
+	// If key exists, update it
+	if _, exists := c.items[key]; exists {
+		c.items[key] = CacheItem{
+			Value:     value,
+			ExpiresAt: time.Now().Add(expiration),
+		}
+		return
+	}
+
+	// If cache is full, remove oldest item
+	if len(c.items) >= c.maxSize {
+		c.evictOldest()
+	}
+
+	// Add new item
 	c.items[key] = CacheItem{
 		Value:     value,
 		ExpiresAt: time.Now().Add(expiration),
 	}
+	c.accessList = append(c.accessList, key)
 }
 
 // Get retrieves an item from the cache if it exists and hasn't expired.
@@ -58,15 +86,25 @@ func (c *Cache) Set(key string, value interface{}, expiration time.Duration) {
 // Thread-safe: Uses read locking to ensure safe concurrent access.
 func (c *Cache) Get(key string) (interface{}, bool) {
 	c.mutex.RLock()
-	defer c.mutex.RUnlock()
 	item, found := c.items[key]
+	c.mutex.RUnlock()
+
 	if !found {
 		return nil, false
 	}
+
 	if time.Now().After(item.ExpiresAt) {
-		delete(c.items, key)
+		c.mutex.Lock()
+		c.removeItem(key)
+		c.mutex.Unlock()
 		return nil, false
 	}
+
+	// Update access order
+	c.mutex.Lock()
+	c.updateAccessOrder(key)
+	c.mutex.Unlock()
+
 	return item.Value, true
 }
 
@@ -86,10 +124,46 @@ func (c *Cache) Delete(key string) {
 func (c *Cache) Cleanup() {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
+
 	now := time.Now()
-	for key, item := range c.items {
-		if now.After(item.ExpiresAt) {
+	var newAccessList []string
+
+	for _, key := range c.accessList {
+		if item, exists := c.items[key]; exists && !now.After(item.ExpiresAt) {
+			newAccessList = append(newAccessList, key)
+		} else {
 			delete(c.items, key)
 		}
 	}
+
+	c.accessList = newAccessList
+}
+
+// evictOldest removes the least recently used item from the cache
+func (c *Cache) evictOldest() {
+	if len(c.accessList) > 0 {
+		oldest := c.accessList[0]
+		c.removeItem(oldest)
+	}
+}
+
+// removeItem removes an item from both the cache and access list
+func (c *Cache) removeItem(key string) {
+	delete(c.items, key)
+	for i, k := range c.accessList {
+		if k == key {
+			c.accessList = append(c.accessList[:i], c.accessList[i+1:]...)
+			break
+		}
+	}
+}
+
+// updateAccessOrder moves the accessed key to the end of the access list
+func (c *Cache) updateAccessOrder(key string) {
+	for i, k := range c.accessList {
+		if k == key {
+			c.accessList = append(append(c.accessList[:i], c.accessList[i+1:]...), key)
+			break
+		}
+	}
 }

helpers.go

@@ -128,11 +128,19 @@ func (t *TraefikOidc) getNewTokenWithRefreshToken(refreshToken string) (*TokenRe
 // handleExpiredToken manages token expiration by clearing the session
 // and initiating a new authentication flow.
 func (t *TraefikOidc) handleExpiredToken(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) {
-	if err := session.Clear(req, rw); err != nil {
-		t.logger.Errorf("Failed to clear session: %v", err)
+	// Clear authentication data but preserve CSRF state
+	session.SetAuthenticated(false)
+	session.SetAccessToken("")
+	session.SetRefreshToken("")
+	session.SetEmail("")
+	
+	// Save the cleared session state
+	if err := session.Save(req, rw); err != nil {
+		t.logger.Errorf("Failed to save cleared session: %v", err)
 		http.Error(rw, "Internal Server Error", http.StatusInternalServerError)
 		return
 	}
+	
 	t.defaultInitiateAuthentication(rw, req, session, redirectURL)
 }
 

jwt.go

@@ -83,12 +83,37 @@ func parseJWT(tokenString string) (*JWT, error) {
 // It checks:
 //   - issuer (iss) matches the expected issuer URL
 //   - audience (aud) includes the client ID
-//   - expiration time (exp) is in the future
-//   - issued at time (iat) is in the past
+//   - expiration time (exp) is in the future (with clock skew tolerance)
+//   - issued at time (iat) is in the past (with clock skew tolerance)
+//   - not before time (nbf) is in the past (with clock skew tolerance)
 //   - subject (sub) is present and not empty
+//   - algorithm matches expected value to prevent algorithm switching attacks
 // Returns an error if any validation fails.
 func (j *JWT) Verify(issuerURL, clientID string) error {
+	// Debug logging of validation parameters
+	fmt.Printf("Validating token against:\nIssuer: %s\nClient ID: %s\n", issuerURL, clientID)
+	// Debug logging of token header
+	fmt.Printf("Token header: %+v\n", j.Header)
+
+	// Validate algorithm to prevent algorithm switching attacks
+	alg, ok := j.Header["alg"].(string)
+	if !ok {
+		return fmt.Errorf("missing 'alg' header")
+	}
+	// List of supported algorithms - should match those in verifySignature
+	supportedAlgs := map[string]bool{
+		"RS256": true, "RS384": true, "RS512": true,
+		"PS256": true, "PS384": true, "PS512": true,
+		"ES256": true, "ES384": true, "ES512": true,
+	}
+	if !supportedAlgs[alg] {
+		return fmt.Errorf("unsupported algorithm: %s", alg)
+	}
+
 	claims := j.Claims
+	
+	// Debug logging of all claims
+	fmt.Printf("Token claims: %+v\n", claims)
 
 	iss, ok := claims["iss"].(string)
 	if !ok {
@@ -122,6 +147,19 @@ func (j *JWT) Verify(issuerURL, clientID string) error {
 		return err
 	}
 
+	// Validate nbf (not before) claim if present
+	if nbf, ok := claims["nbf"].(float64); ok {
+		if err := verifyNotBefore(nbf); err != nil {
+			return err
+		}
+	}
+
+	// Validate jti (JWT ID) claim if present
+	if jti, ok := claims["jti"].(string); ok {
+		// Could add replay detection here if needed
+		_ = jti
+	}
+
 	sub, ok := claims["sub"].(string)
 	if !ok || sub == "" {
 		return fmt.Errorf("missing or empty 'sub' claim")
@@ -138,6 +176,10 @@ func (j *JWT) Verify(issuerURL, clientID string) error {
 //   - expectedAudience: The expected audience value
 // Returns an error if validation fails.
 func verifyAudience(tokenAudience interface{}, expectedAudience string) error {
+	// Debug logging
+	fmt.Printf("Verifying audience:\nToken aud: %+v\nExpected: %s\n", 
+		tokenAudience, expectedAudience)
+
 	switch aud := tokenAudience.(type) {
 	case string:
 		if aud != expectedAudience {
@@ -167,35 +209,106 @@ func verifyAudience(tokenAudience interface{}, expectedAudience string) error {
 //   - expectedIssuer: The expected issuer URL
 // Returns an error if validation fails.
 func verifyIssuer(tokenIssuer, expectedIssuer string) error {
+	// Debug logging
+	fmt.Printf("Verifying issuer:\nToken iss: %s\nExpected: %s\n", 
+		tokenIssuer, expectedIssuer)
+
 	if tokenIssuer != expectedIssuer {
-		return fmt.Errorf("invalid issuer")
+		return fmt.Errorf("invalid issuer (token: %s, expected: %s)",
+			tokenIssuer, expectedIssuer)
 	}
 	return nil
 }
 
+// Clock skew tolerance for time-based validations
+const clockSkewTolerance = 2 * time.Minute
+
 // verifyExpiration checks if the token's expiration time has passed.
-// The expiration time is compared against the current time.
+// The expiration time is compared against the current time with clock skew tolerance.
 // Parameters:
 //   - expiration: The expiration timestamp from the token
 // Returns an error if the token has expired.
 func verifyExpiration(expiration float64) error {
 	expirationTime := time.Unix(int64(expiration), 0)
-	if time.Now().After(expirationTime) {
-		return fmt.Errorf("token has expired")
+	// Truncate current time to seconds for consistent comparison
+	now := time.Now().Truncate(time.Second)
+	skewedNow := now.Add(clockSkewTolerance)
+	
+	// Debug logging
+	fmt.Printf("Token exp: %v\nCurrent time: %v\nSkewed time: %v\nSkew: %v\n",
+		expirationTime.UTC(),
+		now.UTC(),
+		skewedNow.UTC(),
+		clockSkewTolerance)
+	
+	// Allow tokens that expire exactly now
+	if expirationTime.Equal(now) {
+		return nil
+	}
+	
+	if skewedNow.After(expirationTime) {
+		return fmt.Errorf("token has expired (exp: %v, now: %v)",
+			expirationTime.UTC(), now.UTC())
 	}
 	return nil
 }
 
 // verifyIssuedAt validates the token's issued-at time.
-// Ensures the token wasn't issued in the future, which could
-// indicate clock skew or a malicious token.
+// Ensures the token wasn't issued in the future, accounting for clock skew.
 // Parameters:
 //   - issuedAt: The issued-at timestamp from the token
 // Returns an error if the token was issued in the future.
 func verifyIssuedAt(issuedAt float64) error {
 	issuedAtTime := time.Unix(int64(issuedAt), 0)
-	if time.Now().Before(issuedAtTime) {
-		return fmt.Errorf("token used before issued")
+	// Truncate current time to seconds for consistent comparison
+	now := time.Now().Truncate(time.Second)
+	skewedNow := now.Add(-clockSkewTolerance)
+	
+	// Debug logging
+	fmt.Printf("Token iat: %v\nCurrent time: %v\nSkewed time: %v\nSkew: %v\n",
+		issuedAtTime.UTC(),
+		now.UTC(),
+		skewedNow.UTC(),
+		clockSkewTolerance)
+	
+	// Allow tokens issued in the same second as current time
+	if issuedAtTime.Equal(now) {
+		return nil
+	}
+	
+	if skewedNow.Before(issuedAtTime) {
+		return fmt.Errorf("token used before issued (iat: %v, now: %v)", 
+			issuedAtTime.UTC(), now.UTC())
+	}
+	return nil
+}
+
+// verifyNotBefore validates the token's not-before time if present.
+// Ensures the token is not used before its valid time period, accounting for clock skew.
+// Parameters:
+//   - notBefore: The not-before timestamp from the token
+// Returns an error if the token is not yet valid.
+func verifyNotBefore(notBefore float64) error {
+	notBeforeTime := time.Unix(int64(notBefore), 0)
+	// Truncate current time to seconds for consistent comparison
+	now := time.Now().Truncate(time.Second)
+	skewedNow := now.Add(-clockSkewTolerance)
+	
+	// Debug logging
+	fmt.Printf("Token nbf: %v\nCurrent time: %v\nSkewed time: %v\nSkew: %v\n",
+		notBeforeTime.UTC(),
+		now.UTC(),
+		skewedNow.UTC(),
+		clockSkewTolerance)
+	
+	// Allow tokens that become valid exactly now
+	if notBeforeTime.Equal(now) {
+		return nil
+	}
+	
+	if skewedNow.Before(notBeforeTime) {
+		return fmt.Errorf("token not yet valid (nbf: %v, now: %v)",
+			notBeforeTime.UTC(), now.UTC())
 	}
 	return nil
 }
@@ -211,6 +324,9 @@ func verifyIssuedAt(issuedAt float64) error {
 //   - alg: The signature algorithm identifier
 // Returns an error if signature verification fails.
 func verifySignature(tokenString string, publicKeyPEM []byte, alg string) error {
+	// Debug logging
+	fmt.Printf("Verifying signature with algorithm: %s\n", alg)
+	
 	// Split the token into its three parts
 	parts := strings.Split(tokenString, ".")
 	if len(parts) != 3 {

main.go

@@ -175,22 +175,39 @@ func (t *TraefikOidc) VerifyJWTSignatureAndClaims(jwt *JWT, token string) error
 
 // New creates a new instance of the OIDC middleware
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
+	if config == nil {
+		config = CreateConfig()
+	}
+
+	// Generate default session encryption key if not provided
+	if config.SessionEncryptionKey == "" {
+		// Generate a fixed key for Traefik Hub testing
+		config.SessionEncryptionKey = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+	}
+
+	// Ensure key meets minimum length requirement
+	if len(config.SessionEncryptionKey) < minEncryptionKeyLength {
+		return nil, fmt.Errorf("encryption key must be at least %d bytes long", minEncryptionKeyLength)
+	}
+
 	// Setup HTTP client
 	transport := &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
 			dialer := &net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
+				Timeout:   15 * time.Second,  // Reduced timeout
+				KeepAlive: 15 * time.Second,  // Reduced keepalive
 			}
 			return dialer.DialContext(ctx, network, addr)
 		},
 		ForceAttemptHTTP2:     true,
-		TLSHandshakeTimeout:   10 * time.Second,
+		TLSHandshakeTimeout:   5 * time.Second,   // Reduced from 10s
 		ExpectContinueTimeout: 0,
-		MaxIdleConns:          100,
-		MaxIdleConnsPerHost:   100,
-		IdleConnTimeout:       90 * time.Second,
+		MaxIdleConns:          30,                // Reduced from 100
+		MaxIdleConnsPerHost:   10,                // Reduced from 100
+		IdleConnTimeout:       30 * time.Second,   // Reduced from 90s
+		DisableKeepAlives:     false,             // Enable connection reuse
+		MaxConnsPerHost:       50,                // Limit max connections
 	}
 
 	var httpClient *http.Client
@@ -198,7 +215,7 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		httpClient = config.HTTPClient
 	} else {
 		httpClient = &http.Client{
-			Timeout:   time.Second * 30,
+			Timeout:   time.Second * 15, // Reduced timeout
 			Transport: transport,
 		}
 	}
@@ -258,21 +275,42 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 // initializeMetadata discovers and initializes the provider metadata
 func (t *TraefikOidc) initializeMetadata(providerURL string) {
 	t.logger.Debug("Starting provider metadata discovery")
-	metadata, err := discoverProviderMetadata(providerURL, t.httpClient, t.logger)
 	
-	if err != nil {
-		t.logger.Errorf("Failed to discover provider metadata: %v", err)
-	} else if metadata != nil {
-		t.logger.Debug("Using provider metadata")
-		t.jwksURL = metadata.JWKSURL
-		t.authURL = metadata.AuthURL
-		t.tokenURL = metadata.TokenURL
-		t.issuerURL = metadata.Issuer
-		t.revocationURL = metadata.RevokeURL
-		t.endSessionURL = metadata.EndSessionURL
+	// Keep retrying until successful
+	backoff := time.Second
+	maxBackoff := 30 * time.Second
+	for {
+		metadata, err := discoverProviderMetadata(providerURL, t.httpClient, t.logger)
+		
+		if err != nil {
+			t.logger.Errorf("Failed to discover provider metadata: %v, retrying in %v", err, backoff)
+			time.Sleep(backoff)
+			
+			// Exponential backoff with max
+			backoff *= 2
+			if backoff > maxBackoff {
+				backoff = maxBackoff
+			}
+			continue
+		}
+		
+		if metadata != nil {
+			t.logger.Debug("Successfully initialized provider metadata")
+			t.jwksURL = metadata.JWKSURL
+			t.authURL = metadata.AuthURL
+			t.tokenURL = metadata.TokenURL
+			t.issuerURL = metadata.Issuer
+			t.revocationURL = metadata.RevokeURL
+			t.endSessionURL = metadata.EndSessionURL
+			
+			// Only close channel on success
+			close(t.initComplete)
+			return
+		}
+		
+		t.logger.Error("Received nil metadata, retrying")
+		time.Sleep(backoff)
 	}
-
-	close(t.initComplete)
 }
 
 // discoverProviderMetadata fetches the OIDC provider metadata
@@ -342,14 +380,18 @@ func (t *TraefikOidc) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	select {
 	case <-t.initComplete:
 		if t.issuerURL == "" {
-			t.logger.Debug("OIDC middleware not yet initialized")
-			http.Error(rw, "OIDC middleware not yet initialized", http.StatusInternalServerError)
+			t.logger.Error("OIDC provider metadata initialization failed")
+			http.Error(rw, "OIDC provider metadata initialization failed - please check provider availability", http.StatusServiceUnavailable)
 			return
 		}
 	case <-req.Context().Done():
 		t.logger.Debug("Request cancelled")
 		http.Error(rw, "Request cancelled", http.StatusServiceUnavailable)
 		return
+	case <-time.After(30 * time.Second):
+		t.logger.Error("Timeout waiting for OIDC initialization")
+		http.Error(rw, "Timeout waiting for OIDC provider initialization - please try again", http.StatusServiceUnavailable)
+		return
 	}
 
 	// Check if URL is excluded

main_test.go

@@ -67,21 +67,29 @@ func (ts *TestSuite) Setup() {
 	}
 
 	// Create a test JWT token signed with the RSA private key
+	// Create timestamps with proper clock skew
+	now := time.Now()
+	exp := now.Add(1 * time.Hour).Unix()
+	iat := now.Add(-2 * time.Minute).Unix() // Account for clock skew
+	nbf := now.Add(-2 * time.Minute).Unix() // Account for clock skew
+
 	ts.token, err = createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
 		"iss":   "https://test-issuer.com",
 		"aud":   "test-client-id",
-		"exp":   time.Now().Add(1 * time.Hour).Unix(),
-		"iat":   time.Now().Unix(),
+		"exp":   exp,
+		"iat":   iat,
+		"nbf":   nbf,
 		"sub":   "test-subject",
 		"email": "user@example.com",
 		"nonce": "test-nonce",
+		"jti":   generateRandomString(16),
 	})
 	if err != nil {
 		ts.t.Fatalf("Failed to create test JWT: %v", err)
 	}
 
 	logger := NewLogger("info")
-	ts.sessionManager = NewSessionManager("test-secret-key", false, logger)
+	ts.sessionManager = NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, logger)
 
 	// Common TraefikOidc instance
 	ts.tOidc = &TraefikOidc{
@@ -611,7 +619,7 @@ func TestHandleCallback(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			logger := NewLogger("info")
-			sessionManager := NewSessionManager("test-secret-key", false, logger)
+			sessionManager := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, logger)
 
 			// Create a new instance for each test to avoid state carryover
 			tOidc := &TraefikOidc{
@@ -916,7 +924,7 @@ func TestHandleLogout(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			logger := NewLogger("info")
-			sessionManager := NewSessionManager("test-secret-key", false, logger)
+			sessionManager := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, logger)
 			tOidc := &TraefikOidc{
 				revocationURL:  mockRevocationServer.URL,
 				endSessionURL:  tc.endSessionURL,
@@ -1205,7 +1213,7 @@ func TestHandleExpiredToken(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			logger := NewLogger("info")
-			sessionManager := NewSessionManager("test-secret-key", false, logger)
+			sessionManager := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, logger)
 
 			tOidc := &TraefikOidc{
 				sessionManager: sessionManager,
@@ -1440,6 +1448,12 @@ func TestServeHTTPRolesAndGroups(t *testing.T) {
 	ts := &TestSuite{t: t}
 	ts.Setup()
 
+	// Create consistent timestamps for all test cases
+	now := time.Now()
+	exp := now.Add(1 * time.Hour).Unix()
+	iat := now.Add(-2 * time.Minute).Unix() // Account for clock skew
+	nbf := now.Add(-2 * time.Minute).Unix() // Account for clock skew
+
 	tests := []struct {
 		name                  string
 		allowedRolesAndGroups map[string]struct{}
@@ -1456,11 +1470,13 @@ func TestServeHTTPRolesAndGroups(t *testing.T) {
 			claims: map[string]interface{}{
 				"iss":    "https://test-issuer.com",
 				"aud":    "test-client-id",
-				"exp":    time.Now().Add(1 * time.Hour).Unix(),
-				"iat":    time.Now().Unix(),
+				"exp":    exp,
+				"iat":    iat,
+				"nbf":    nbf,
 				"sub":    "test-subject",
 				"roles":  []interface{}{"admin", "user"},
 				"groups": []interface{}{"group1"},
+				"jti":    generateRandomString(16),
 			},
 			setupSession: func(session *SessionData) {
 				session.SetAuthenticated(true)
@@ -1480,11 +1496,13 @@ func TestServeHTTPRolesAndGroups(t *testing.T) {
 			claims: map[string]interface{}{
 				"iss":    "https://test-issuer.com",
 				"aud":    "test-client-id",
-				"exp":    time.Now().Add(1 * time.Hour).Unix(),
-				"iat":    time.Now().Unix(),
+				"exp":    exp,
+				"iat":    iat,
+				"nbf":    nbf,
 				"sub":    "test-subject",
 				"roles":  []interface{}{"user"},
 				"groups": []interface{}{"allowed-group"},
+				"jti":    generateRandomString(16),
 			},
 			setupSession: func(session *SessionData) {
 				session.SetAuthenticated(true)
@@ -1505,11 +1523,13 @@ func TestServeHTTPRolesAndGroups(t *testing.T) {
 			claims: map[string]interface{}{
 				"iss":    "https://test-issuer.com",
 				"aud":    "test-client-id",
-				"exp":    time.Now().Add(1 * time.Hour).Unix(),
-				"iat":    time.Now().Unix(),
+				"exp":    exp,
+				"iat":    iat,
+				"nbf":    nbf,
 				"sub":    "test-subject",
 				"roles":  []interface{}{"user"},
 				"groups": []interface{}{"regular-group"},
+				"jti":    generateRandomString(16),
 			},
 			setupSession: func(session *SessionData) {
 				session.SetAuthenticated(true)
@@ -1523,11 +1543,13 @@ func TestServeHTTPRolesAndGroups(t *testing.T) {
 			claims: map[string]interface{}{
 				"iss":    "https://test-issuer.com",
 				"aud":    "test-client-id",
-				"exp":    time.Now().Add(1 * time.Hour).Unix(),
-				"iat":    time.Now().Unix(),
+				"exp":    exp,
+				"iat":    iat,
+				"nbf":    nbf,
 				"sub":    "test-subject",
 				"roles":  []interface{}{"user"},
 				"groups": []interface{}{"regular-group"},
+				"jti":    generateRandomString(16),
 			},
 			setupSession: func(session *SessionData) {
 				session.SetAuthenticated(true)
@@ -1545,9 +1567,11 @@ func TestServeHTTPRolesAndGroups(t *testing.T) {
 			claims: map[string]interface{}{
 				"iss": "https://test-issuer.com",
 				"aud": "test-client-id",
-				"exp": time.Now().Add(1 * time.Hour).Unix(),
-				"iat": time.Now().Unix(),
+				"exp": exp,
+				"iat": iat,
+				"nbf": nbf,
 				"sub": "test-subject",
+				"jti": generateRandomString(16),
 			},
 			setupSession: func(session *SessionData) {
 				session.SetAuthenticated(true)

session.go

@@ -1,27 +1,39 @@
 package traefikoidc
 
 import (
+	"bytes"
+	"compress/gzip"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
+	"sync"
+	"time"
 
 	"github.com/gorilla/sessions"
 )
 
+// generateSecureRandomString creates a cryptographically secure random string of specified length
+func generateSecureRandomString(length int) string {
+	bytes := make([]byte, length)
+	if _, err := rand.Read(bytes); err != nil {
+		panic("failed to generate random string")
+	}
+	return hex.EncodeToString(bytes)
+}
+
 // Cookie names and configuration constants used for session management
+var (
+	// Using random prefixes to make cookie names less predictable
+	mainCookieName    = "_oidc_raczylo_m_" + generateSecureRandomString(8)
+	accessTokenCookie = "_oidc_raczylo_a_" + generateSecureRandomString(8)
+	refreshTokenCookie = "_oidc_raczylo_r_" + generateSecureRandomString(8)
+)
+
 const (
-	// mainCookieName is the name of the main session cookie that stores authentication state
-	// and basic user information like email and CSRF tokens
-	mainCookieName = "_raczylo_oidc"
-
-	// accessTokenCookie is the name of the cookie that stores the OIDC access token
-	// This may be split into multiple cookies if the token is large
-	accessTokenCookie = "_raczylo_oidc_access"
-
-	// refreshTokenCookie is the name of the cookie that stores the OIDC refresh token
-	// This may be split into multiple cookies if the token is large
-	refreshTokenCookie = "_raczylo_oidc_refresh"
-
 	// maxCookieSize is the maximum size for each cookie chunk.
 	// This value is calculated to ensure the final cookie size stays within browser limits:
 	// 1. Browser cookie size limit is typically 4096 bytes
@@ -34,8 +46,49 @@ const (
 	//    - Solving for x: x ≤ 3044
 	// 4. We use 2000 as a conservative limit to account for cookie metadata
 	maxCookieSize = 2000
+
+	// absoluteSessionTimeout defines the maximum lifetime of a session
+	// regardless of activity (24 hours)
+	absoluteSessionTimeout = 24 * time.Hour
+
+	// minEncryptionKeyLength defines the minimum length for the encryption key
+	minEncryptionKeyLength = 32
 )
 
+// compressToken compresses a token using gzip and base64 encodes it
+func compressToken(token string) string {
+	var b bytes.Buffer
+	gz := gzip.NewWriter(&b)
+	if _, err := gz.Write([]byte(token)); err != nil {
+		return token // fallback to uncompressed on error
+	}
+	if err := gz.Close(); err != nil {
+		return token
+	}
+	return base64.StdEncoding.EncodeToString(b.Bytes())
+}
+
+// decompressToken decompresses a base64 encoded gzipped token
+func decompressToken(compressed string) string {
+	data, err := base64.StdEncoding.DecodeString(compressed)
+	if err != nil {
+		return compressed // return as-is if not base64
+	}
+	
+	gz, err := gzip.NewReader(bytes.NewReader(data))
+	if err != nil {
+		return compressed
+	}
+	defer gz.Close()
+	
+	decompressed, err := io.ReadAll(gz)
+	if err != nil {
+		return compressed
+	}
+	
+	return string(decompressed)
+}
+
 // SessionManager handles the management of multiple session cookies for OIDC authentication.
 // It provides functionality for storing and retrieving authentication state, tokens,
 // and other session-related data across multiple cookies to handle large tokens.
@@ -48,6 +101,9 @@ type SessionManager struct {
 
 	// logger provides structured logging capabilities
 	logger *Logger
+
+	// sessionPool is a sync.Pool for reusing SessionData objects
+	sessionPool sync.Pool
 }
 
 // NewSessionManager creates a new session manager with the specified configuration.
@@ -57,11 +113,27 @@ type SessionManager struct {
 //   - logger: Logger instance for recording session-related events
 // The manager handles session creation, storage, and cookie security settings.
 func NewSessionManager(encryptionKey string, forceHTTPS bool, logger *Logger) *SessionManager {
-	return &SessionManager{
+	// Validate encryption key length
+	if len(encryptionKey) < minEncryptionKeyLength {
+		panic(fmt.Sprintf("encryption key must be at least %d bytes long", minEncryptionKeyLength))
+	}
+
+	sm := &SessionManager{
 		store:      sessions.NewCookieStore([]byte(encryptionKey)),
 		forceHTTPS: forceHTTPS,
 		logger:     logger,
 	}
+
+	// Initialize session pool
+	sm.sessionPool.New = func() interface{} {
+		return &SessionData{
+			manager:           sm,
+			accessTokenChunks: make(map[int]*sessions.Session),
+			refreshTokenChunks: make(map[int]*sessions.Session),
+		}
+	}
+
+	return sm
 }
 
 // getSessionOptions returns secure session options configured for the current request.
@@ -77,7 +149,7 @@ func (sm *SessionManager) getSessionOptions(isSecure bool) *sessions.Options {
 		HttpOnly: true,
 		Secure:   isSecure || sm.forceHTTPS,
 		SameSite: http.SameSiteLaxMode,
-		MaxAge:   ConstSessionTimeout,
+		MaxAge:   int(absoluteSessionTimeout.Seconds()),
 		Path:     "/",
 	}
 }
@@ -87,33 +159,49 @@ func (sm *SessionManager) getSessionOptions(isSecure bool) *sessions.Options {
 // and combines them into a single SessionData structure for easy access.
 // Returns an error if any session component cannot be loaded.
 func (sm *SessionManager) GetSession(r *http.Request) (*SessionData, error) {
-	mainSession, err := sm.store.Get(r, mainCookieName)
+	// Get session from pool
+	sessionData := sm.sessionPool.Get().(*SessionData)
+	sessionData.request = r
+
+	var err error
+	sessionData.mainSession, err = sm.store.Get(r, mainCookieName)
 	if err != nil {
+		sm.sessionPool.Put(sessionData)
 		return nil, fmt.Errorf("failed to get main session: %w", err)
 	}
 
-	accessSession, err := sm.store.Get(r, accessTokenCookie)
+	// Check for absolute session timeout
+	if createdAt, ok := sessionData.mainSession.Values["created_at"].(int64); ok {
+		if time.Since(time.Unix(createdAt, 0)) > absoluteSessionTimeout {
+			sessionData.Clear(r, nil) // Clear expired session
+			sm.sessionPool.Put(sessionData)
+			return nil, fmt.Errorf("session expired")
+		}
+	}
+
+	sessionData.accessSession, err = sm.store.Get(r, accessTokenCookie)
 	if err != nil {
+		sm.sessionPool.Put(sessionData)
 		return nil, fmt.Errorf("failed to get access token session: %w", err)
 	}
 
-	refreshSession, err := sm.store.Get(r, refreshTokenCookie)
+	sessionData.refreshSession, err = sm.store.Get(r, refreshTokenCookie)
 	if err != nil {
+		sm.sessionPool.Put(sessionData)
 		return nil, fmt.Errorf("failed to get refresh token session: %w", err)
 	}
 
-	sessionData := &SessionData{
-		manager:        sm,
-		request:        r,
-		mainSession:    mainSession,
-		accessSession:  accessSession,
-		refreshSession: refreshSession,
+	// Clear and reuse chunk maps
+	for k := range sessionData.accessTokenChunks {
+		delete(sessionData.accessTokenChunks, k)
+	}
+	for k := range sessionData.refreshTokenChunks {
+		delete(sessionData.refreshTokenChunks, k)
 	}
 
-	// Retrieve chunked access token sessions
-	sessionData.accessTokenChunks = sm.getTokenChunkSessions(r, accessTokenCookie)
-	// Retrieve chunked refresh token sessions
-	sessionData.refreshTokenChunks = sm.getTokenChunkSessions(r, refreshTokenCookie)
+	// Retrieve chunked token sessions
+	sm.getTokenChunkSessions(r, accessTokenCookie, sessionData.accessTokenChunks)
+	sm.getTokenChunkSessions(r, refreshTokenCookie, sessionData.refreshTokenChunks)
 
 	return sessionData, nil
 }
@@ -122,10 +210,8 @@ func (sm *SessionManager) GetSession(r *http.Request) (*SessionData, error) {
 // Parameters:
 //   - r: The HTTP request
 //   - baseName: The base name for the token's session cookies
-// Returns a map of chunk index to session, used for handling large tokens
-// that exceed single cookie size limits.
-func (sm *SessionManager) getTokenChunkSessions(r *http.Request, baseName string) map[int]*sessions.Session {
-	chunks := make(map[int]*sessions.Session)
+//   - chunks: Map to store the chunks in
+func (sm *SessionManager) getTokenChunkSessions(r *http.Request, baseName string, chunks map[int]*sessions.Session) {
 	for i := 0; ; i++ {
 		sessionName := fmt.Sprintf("%s_%d", baseName, i)
 		session, err := sm.store.Get(r, sessionName)
@@ -135,7 +221,6 @@ func (sm *SessionManager) getTokenChunkSessions(r *http.Request, baseName string
 		}
 		chunks[i] = session
 	}
-	return chunks
 }
 
 // SessionData holds all session information for an authenticated user.
@@ -237,7 +322,15 @@ func (sd *SessionData) Clear(r *http.Request, w http.ResponseWriter) error {
 	sd.clearTokenChunks(r, sd.accessTokenChunks)
 	sd.clearTokenChunks(r, sd.refreshTokenChunks)
 
-	return sd.Save(r, w)
+	var err error
+	if w != nil {
+		err = sd.Save(r, w)
+	}
+	
+	// Return session to pool
+	sd.manager.sessionPool.Put(sd)
+	
+	return err
 }
 
 // clearTokenChunks removes all session chunks for a given token type.
@@ -253,16 +346,31 @@ func (sd *SessionData) clearTokenChunks(r *http.Request, chunks map[int]*session
 }
 
 // GetAuthenticated returns whether the current session is authenticated.
-// Returns true if the user has successfully completed OIDC authentication,
-// false otherwise or if the authentication status cannot be determined.
+// Returns true if the user has successfully completed OIDC authentication
+// and the session hasn't expired, false otherwise.
 func (sd *SessionData) GetAuthenticated() bool {
 	auth, _ := sd.mainSession.Values["authenticated"].(bool)
-	return auth
+	if !auth {
+		return false
+	}
+
+	// Check session expiration
+	createdAt, ok := sd.mainSession.Values["created_at"].(int64)
+	if !ok {
+		return false
+	}
+	return time.Since(time.Unix(createdAt, 0)) <= absoluteSessionTimeout
 }
 
-// SetAuthenticated updates the session's authentication status.
+// SetAuthenticated updates the session's authentication status and rotates session ID.
 // This should be called after successful OIDC authentication or during logout.
+// Session ID rotation helps prevent session fixation attacks.
 func (sd *SessionData) SetAuthenticated(value bool) {
+	if value {
+		// Generate new session ID and set creation time
+		sd.mainSession.ID = generateSecureRandomString(32)
+		sd.mainSession.Values["created_at"] = time.Now().Unix()
+	}
 	sd.mainSession.Values["authenticated"] = value
 }
 
@@ -273,6 +381,10 @@ func (sd *SessionData) SetAuthenticated(value bool) {
 func (sd *SessionData) GetAccessToken() string {
 	token, _ := sd.accessSession.Values["token"].(string)
 	if token != "" {
+		compressed, _ := sd.accessSession.Values["compressed"].(bool)
+		if compressed {
+			return decompressToken(token)
+		}
 		return token
 	}
 
@@ -291,25 +403,52 @@ func (sd *SessionData) GetAccessToken() string {
 		chunks = append(chunks, chunk)
 	}
 
-	return strings.Join(chunks, "")
+	token = strings.Join(chunks, "")
+	compressed, _ := sd.accessSession.Values["compressed"].(bool)
+	if compressed {
+		return decompressToken(token)
+	}
+	return token
 }
 
 // SetAccessToken stores the access token in the session.
-// If the token exceeds maxCookieSize, it is automatically split into
+// If the token exceeds maxCookieSize, it is automatically compressed and split into
 // multiple cookie chunks to handle large tokens while staying within
 // browser cookie size limits. Any existing token or chunks are cleared
 // before setting the new token.
+// expireAccessTokenChunks expires any existing access token chunk cookies
+func (sd *SessionData) expireAccessTokenChunks(w http.ResponseWriter) {
+	for i := 0; ; i++ {
+		sessionName := fmt.Sprintf("%s_%d", accessTokenCookie, i)
+		session, err := sd.manager.store.Get(sd.request, sessionName)
+		if err != nil || session.IsNew {
+			break
+		}
+		// Expire the cookie
+		session.Options.MaxAge = -1
+		session.Values = make(map[interface{}]interface{})
+		// Save expired cookie
+		if err := session.Save(sd.request, w); err != nil {
+			sd.manager.logger.Errorf("Failed to save expired cookie: %v", err)
+		}
+	}
+}
+
 func (sd *SessionData) SetAccessToken(token string) {
-	// Clear existing chunks
-	sd.clearTokenChunks(sd.request, sd.accessTokenChunks)
+	// Clear and prepare chunks map for new token
 	sd.accessTokenChunks = make(map[int]*sessions.Session)
 
-	if len(token) <= maxCookieSize {
-		sd.accessSession.Values["token"] = token
+	// Compress token
+	compressed := compressToken(token)
+
+	if len(compressed) <= maxCookieSize {
+		sd.accessSession.Values["token"] = compressed
+		sd.accessSession.Values["compressed"] = true
 	} else {
-		// Split token into chunks
+		// Split compressed token into chunks
 		sd.accessSession.Values["token"] = ""
-		chunks := splitIntoChunks(token, maxCookieSize)
+		sd.accessSession.Values["compressed"] = true
+		chunks := splitIntoChunks(compressed, maxCookieSize)
 		for i, chunk := range chunks {
 			sessionName := fmt.Sprintf("%s_%d", accessTokenCookie, i)
 			session, _ := sd.manager.store.Get(sd.request, sessionName)
@@ -326,6 +465,10 @@ func (sd *SessionData) SetAccessToken(token string) {
 func (sd *SessionData) GetRefreshToken() string {
 	token, _ := sd.refreshSession.Values["token"].(string)
 	if token != "" {
+		compressed, _ := sd.refreshSession.Values["compressed"].(bool)
+		if compressed {
+			return decompressToken(token)
+		}
 		return token
 	}
 
@@ -344,25 +487,52 @@ func (sd *SessionData) GetRefreshToken() string {
 		chunks = append(chunks, chunk)
 	}
 
-	return strings.Join(chunks, "")
+	token = strings.Join(chunks, "")
+	compressed, _ := sd.refreshSession.Values["compressed"].(bool)
+	if compressed {
+		return decompressToken(token)
+	}
+	return token
 }
 
 // SetRefreshToken stores the refresh token in the session.
-// If the token exceeds maxCookieSize, it is automatically split into
+// If the token exceeds maxCookieSize, it is automatically compressed and split into
 // multiple cookie chunks to handle large tokens while staying within
 // browser cookie size limits. Any existing token or chunks are cleared
 // before setting the new token.
+// expireRefreshTokenChunks expires any existing refresh token chunk cookies
+func (sd *SessionData) expireRefreshTokenChunks(w http.ResponseWriter) {
+	for i := 0; ; i++ {
+		sessionName := fmt.Sprintf("%s_%d", refreshTokenCookie, i)
+		session, err := sd.manager.store.Get(sd.request, sessionName)
+		if err != nil || session.IsNew {
+			break
+		}
+		// Expire the cookie
+		session.Options.MaxAge = -1
+		session.Values = make(map[interface{}]interface{})
+		// Save expired cookie
+		if err := session.Save(sd.request, w); err != nil {
+			sd.manager.logger.Errorf("Failed to save expired cookie: %v", err)
+		}
+	}
+}
+
 func (sd *SessionData) SetRefreshToken(token string) {
-	// Clear existing chunks
-	sd.clearTokenChunks(sd.request, sd.refreshTokenChunks)
+	// Clear and prepare chunks map for new token
 	sd.refreshTokenChunks = make(map[int]*sessions.Session)
 
-	if len(token) <= maxCookieSize {
-		sd.refreshSession.Values["token"] = token
+	// Compress token
+	compressed := compressToken(token)
+
+	if len(compressed) <= maxCookieSize {
+		sd.refreshSession.Values["token"] = compressed
+		sd.refreshSession.Values["compressed"] = true
 	} else {
-		// Split token into chunks
+		// Split compressed token into chunks
 		sd.refreshSession.Values["token"] = ""
-		chunks := splitIntoChunks(token, maxCookieSize)
+		sd.refreshSession.Values["compressed"] = true
+		chunks := splitIntoChunks(compressed, maxCookieSize)
 		for i, chunk := range chunks {
 			sessionName := fmt.Sprintf("%s_%d", refreshTokenCookie, i)
 			session, _ := sd.manager.store.Get(sd.request, sessionName)

session_test.go

@@ -1,57 +1,254 @@
 package traefikoidc
 
 import (
+	"math/rand"
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 )
 
+func init() {
+	// Initialize random seed
+	rand.Seed(time.Now().UnixNano())
+}
+
+// generateRandomString creates a random string of specified length
+func generateRandomString(length int) string {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = charset[rand.Intn(len(charset))]
+	}
+	return string(b)
+}
+
+// TestTokenCompression tests the token compression functionality
+func TestTokenCompression(t *testing.T) {
+	tests := []struct {
+		name     string
+		token    string
+		wantSize int // Expected size after compression (approximate)
+	}{
+		{
+			name:     "Short token",
+			token:    "shorttoken",
+			wantSize: 50, // Base64 encoded gzip has overhead for small content
+		},
+		{
+			name:     "Repeating content",
+			token:    strings.Repeat("abcdef", 1000),
+			wantSize: 100, // Should compress well due to repetition
+		},
+		{
+			name:     "Random content",
+			token:    generateRandomString(1000),
+			wantSize: 2000, // Random content won't compress much
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			compressed := compressToken(tt.token)
+			decompressed := decompressToken(compressed)
+
+			// Only verify compression ratio for non-short tokens
+			if len(tt.token) > 100 {
+				compressionRatio := float64(len(compressed)) / float64(len(tt.token))
+				t.Logf("Compression ratio for %s: %.2f", tt.name, compressionRatio)
+				
+				if compressionRatio > 1.1 { // Allow up to 10% size increase
+					t.Errorf("Compression increased size too much: original=%d, compressed=%d, ratio=%.2f", 
+						len(tt.token), len(compressed), compressionRatio)
+				}
+			}
+
+			// Verify decompression restores original
+			if decompressed != tt.token {
+				t.Error("Decompression failed to restore original token")
+			}
+
+			// Verify approximate compression ratio
+			if len(compressed) > tt.wantSize*2 {
+				t.Errorf("Compression ratio worse than expected: got=%d, want<%d", len(compressed), tt.wantSize*2)
+			}
+		})
+	}
+}
+
 // TestSessionManager tests the SessionManager functionality
+
+func TestCookiePrefix(t *testing.T) {
+	// Create a session and verify cookie names
+	req := httptest.NewRequest("GET", "/test", nil)
+	rr := httptest.NewRecorder()
+
+	sm := NewSessionManager("0123456789abcdef0123456789abcdef", true, NewLogger("debug"))
+	session, err := sm.GetSession(req)
+	if err != nil {
+		t.Fatalf("Failed to get session: %v", err)
+	}
+
+	// Set some data to ensure cookies are created
+	session.SetAuthenticated(true)
+	
+	// Expire any existing cookies
+	session.expireAccessTokenChunks(rr)
+	session.expireRefreshTokenChunks(rr)
+	
+	// Set new tokens
+	session.SetAccessToken("test_token")
+	session.SetRefreshToken("test_refresh_token")
+
+	if err := session.Save(req, rr); err != nil {
+		t.Fatalf("Failed to save session: %v", err)
+	}
+
+	// Check cookie prefixes
+	cookies := rr.Result().Cookies()
+	for _, cookie := range cookies {
+		if !strings.HasPrefix(cookie.Name, "_oidc_raczylo_") {
+			t.Errorf("Cookie %s does not have expected prefix '_oidc_raczylo_'", cookie.Name)
+		}
+	}
+}
+
+func TestTokenRefreshCleanup(t *testing.T) {
+	req := httptest.NewRequest("GET", "/test", nil)
+	rr := httptest.NewRecorder()
+
+	sm := NewSessionManager("0123456789abcdef0123456789abcdef", true, NewLogger("debug"))
+	session, err := sm.GetSession(req)
+	if err != nil {
+		t.Fatalf("Failed to get session: %v", err)
+	}
+
+	// Set a large token that will be split into chunks
+	largeToken := strings.Repeat("x", 5000)
+	session.SetAccessToken(largeToken)
+	
+	if err := session.Save(req, rr); err != nil {
+		t.Fatalf("Failed to save session: %v", err)
+	}
+
+	// Get initial cookies
+	initialCookies := rr.Result().Cookies()
+
+	// Create a new request with the initial cookies
+	newReq := httptest.NewRequest("GET", "/test", nil)
+	for _, cookie := range initialCookies {
+		newReq.AddCookie(cookie)
+	}
+	newRr := httptest.NewRecorder()
+
+	// Get session with cookies and set a new token
+	newSession, err := sm.GetSession(newReq)
+	if err != nil {
+		t.Fatalf("Failed to get new session: %v", err)
+	}
+
+	// Create a response recorder for expired cookies
+	expiredRr := httptest.NewRecorder()
+
+	// Expire old chunk cookies
+	newSession.expireAccessTokenChunks(expiredRr)
+
+	// Set a smaller token that won't need chunks
+	newSession.SetAccessToken("small_token")
+	
+	// Save session with new token
+	if err := newSession.Save(newReq, newRr); err != nil {
+		t.Fatalf("Failed to save new session: %v", err)
+	}
+
+	// Check cookies in response where old cookies are expired
+	intermediateResponse := expiredRr.Result()
+	intermediateCount := 0
+	chunkCount := 0
+	expiredCount := 0
+
+	for _, cookie := range intermediateResponse.Cookies() {
+		if strings.Contains(cookie.Name, "_oidc_raczylo_a_") && strings.Count(cookie.Name, "_") > 3 {
+			chunkCount++
+			if cookie.MaxAge < 0 {
+				expiredCount++
+				t.Logf("Found expired chunk cookie: %s (MaxAge=%d)", cookie.Name, cookie.MaxAge)
+			}
+		} else if cookie.MaxAge >= 0 {
+			intermediateCount++
+			t.Logf("Found active cookie: %s (MaxAge=%d)", cookie.Name, cookie.MaxAge)
+		}
+	}
+
+	// All chunk cookies should be expired
+	if chunkCount > 0 && chunkCount != expiredCount {
+		t.Errorf("Not all chunk cookies are expired: %d chunks, %d expired", chunkCount, expiredCount)
+	}
+
+	// Should have fewer active cookies after setting smaller token
+	if intermediateCount >= len(initialCookies) {
+		t.Errorf("Expected fewer active cookies after token refresh, got %d, want less than %d", intermediateCount, len(initialCookies))
+	}
+}
+
 func TestSessionManager(t *testing.T) {
 	ts := &TestSuite{t: t}
 	ts.Setup()
 
 	tests := []struct {
-			name                string
-			authenticated       bool
-			email               string
-			accessToken         string
-			refreshToken        string
-			expectedCookieCount int
+		name                string
+		authenticated       bool
+		email              string
+		accessToken        string
+		refreshToken       string
+		expectedCookieCount int
+		wantCompressed     bool // Whether tokens should be compressed
 	}{
-			{
-					name:                "Short tokens",
-					authenticated:       true,
-					email:               "test@example.com",
-					accessToken:         "shortaccesstoken",
-					refreshToken:        "shortrefreshtoken",
-					expectedCookieCount: 3, // main, access, refresh
-			},
-			{
-					name:          "Long tokens exceeding 4096 bytes",
-					authenticated: true,
-					email:         "test@example.com",
-					accessToken:   strings.Repeat("x", 5000),
-					refreshToken:  strings.Repeat("y", 6000),
-					// Recalculate expected cookies based on new maxCookieSize
-					expectedCookieCount: calculateExpectedCookieCount(strings.Repeat("x", 5000), strings.Repeat("y", 6000)),
-			},
-			{
-				name: "REALLY long tokens, exceeding 25000 bytes",
-				authenticated: true,
-				email: "test@example.com",
-				accessToken: strings.Repeat("x", 25000),
-				refreshToken: strings.Repeat("y", 25000),
-				expectedCookieCount: calculateExpectedCookieCount(strings.Repeat("x", 25000), strings.Repeat("y", 25000)),
-			},
-			{
-					name:                "Unauthenticated session",
-					authenticated:       false,
-					email:               "",
-					accessToken:         "",
-					refreshToken:        "",
-					expectedCookieCount: 3, // main, access, refresh
-			},
+		{
+			name:                "Short tokens",
+			authenticated:       true,
+			email:              "test@example.com",
+			accessToken:        "shortaccesstoken",
+			refreshToken:       "shortrefreshtoken",
+			expectedCookieCount: 3, // main, access, refresh
+			wantCompressed:     true,
+		},
+		{
+			name:          "Long tokens exceeding 4096 bytes",
+			authenticated: true,
+			email:         "test@example.com",
+			accessToken:   strings.Repeat("x", 5000),
+			refreshToken:  strings.Repeat("y", 6000),
+			expectedCookieCount: calculateExpectedCookieCount(strings.Repeat("x", 5000), strings.Repeat("y", 6000)),
+			wantCompressed:     true,
+		},
+		{
+			name:          "REALLY long tokens, exceeding 25000 bytes",
+			authenticated: true,
+			email:         "test@example.com",
+			accessToken:   strings.Repeat("x", 25000),
+			refreshToken:  strings.Repeat("y", 25000),
+			expectedCookieCount: calculateExpectedCookieCount(strings.Repeat("x", 25000), strings.Repeat("y", 25000)),
+			wantCompressed:     true,
+		},
+		{
+			name:                "Unauthenticated session",
+			authenticated:       false,
+			email:              "",
+			accessToken:        "",
+			refreshToken:       "",
+			expectedCookieCount: 3, // main, access, refresh
+			wantCompressed:     false,
+		},
+		{
+			name:          "Random content tokens",
+			authenticated: true,
+			email:         "test@example.com",
+			accessToken:   generateRandomString(5000),
+			refreshToken:  generateRandomString(5000),
+			expectedCookieCount: calculateExpectedCookieCount(generateRandomString(5000), generateRandomString(5000)),
+			wantCompressed:     true,
+		},
 	}
 
 	for _, tc := range tests {
@@ -68,6 +265,12 @@ func TestSessionManager(t *testing.T) {
 					// Set session values
 					session.SetAuthenticated(tc.authenticated)
 					session.SetEmail(tc.email)
+					
+					// Expire any existing cookies
+					session.expireAccessTokenChunks(rr)
+					session.expireRefreshTokenChunks(rr)
+					
+					// Set new tokens
 					session.SetAccessToken(tc.accessToken)
 					session.SetRefreshToken(tc.refreshToken)
 
@@ -76,10 +279,45 @@ func TestSessionManager(t *testing.T) {
 							t.Fatalf("Failed to save session: %v", err)
 					}
 
-					// Verify cookies are set
+					// Verify cookies are set and compression is used when appropriate
 					cookies := rr.Result().Cookies()
 					if len(cookies) != tc.expectedCookieCount {
-							t.Errorf("Expected %d cookies, got %d", tc.expectedCookieCount, len(cookies))
+						t.Errorf("Expected %d cookies, got %d", tc.expectedCookieCount, len(cookies))
+					}
+
+					// Verify compression is working by checking token sizes
+					for _, cookie := range cookies {
+						if strings.Contains(cookie.Name, accessTokenCookie) {
+							// Get original and stored sizes
+							originalSize := len(tc.accessToken)
+							storedSize := len(cookie.Value)
+							
+							if originalSize > 100 && tc.wantCompressed {
+								// For large tokens, verify some compression occurred
+								compressionRatio := float64(storedSize) / float64(originalSize)
+								t.Logf("Access token compression ratio: %.2f (original: %d, stored: %d)", 
+									compressionRatio, originalSize, storedSize)
+								
+								if compressionRatio > 0.9 { // Allow some overhead, but should see compression
+									t.Errorf("Expected compression for large token in cookie %s (ratio: %.2f)", 
+										cookie.Name, compressionRatio)
+								}
+							}
+						} else if strings.Contains(cookie.Name, refreshTokenCookie) {
+							originalSize := len(tc.refreshToken)
+							storedSize := len(cookie.Value)
+							
+							if originalSize > 100 && tc.wantCompressed {
+								compressionRatio := float64(storedSize) / float64(originalSize)
+								t.Logf("Refresh token compression ratio: %.2f (original: %d, stored: %d)", 
+									compressionRatio, originalSize, storedSize)
+								
+								if compressionRatio > 0.9 {
+									t.Errorf("Expected compression for large token in cookie %s (ratio: %.2f)", 
+										cookie.Name, compressionRatio)
+								}
+							}
+						}
 					}
 
 					// Create a new request with the cookies
@@ -91,20 +329,27 @@ func TestSessionManager(t *testing.T) {
 					// Get the session again and verify values
 					newSession, err := ts.sessionManager.GetSession(newReq)
 					if err != nil {
-							t.Fatalf("Failed to get new session: %v", err)
+						t.Fatalf("Failed to get new session: %v", err)
 					}
 
+					// Verify session values
 					if newSession.GetAuthenticated() != tc.authenticated {
-							t.Errorf("Authentication status not preserved")
+						t.Errorf("Authentication status not preserved")
 					}
 					if email := newSession.GetEmail(); email != tc.email {
-							t.Errorf("Expected email %s, got %s", tc.email, email)
+						t.Errorf("Expected email %s, got %s", tc.email, email)
 					}
 					if token := newSession.GetAccessToken(); token != tc.accessToken {
-							t.Errorf("Access token not preserved")
+						t.Errorf("Access token not preserved: got len=%d, want len=%d", len(token), len(tc.accessToken))
 					}
 					if token := newSession.GetRefreshToken(); token != tc.refreshToken {
-							t.Errorf("Refresh token not preserved")
+						t.Errorf("Refresh token not preserved: got len=%d, want len=%d", len(token), len(tc.refreshToken))
+					}
+
+					// Verify session pooling by checking if the session is reused
+					session2, _ := ts.sessionManager.GetSession(newReq)
+					if session2 == newSession {
+						t.Error("Session not properly pooled")
 					}
 			})
 	}
@@ -113,17 +358,31 @@ func TestSessionManager(t *testing.T) {
 func calculateExpectedCookieCount(accessToken, refreshToken string) int {
 	count := 3 // main, access, refresh
 
-	// Calculate number of chunks for access token
-	accessChunks := len(splitIntoChunks(accessToken, maxCookieSize))
-	if accessChunks > 1 {
-			count += accessChunks
+	// Helper to calculate chunks for compressed token
+	calculateChunks := func(token string) int {
+		// Compress token (matching the actual implementation)
+		compressed := compressToken(token)
+		
+		// If compressed token fits in one cookie, no additional chunks needed
+		if len(compressed) <= maxCookieSize {
+			return 0
+		}
+		
+		// Calculate chunks needed for compressed token
+		return len(splitIntoChunks(compressed, maxCookieSize))
 	}
 
-	// Calculate number of chunks for refresh token
-	refreshChunks := len(splitIntoChunks(refreshToken, maxCookieSize))
-	if refreshChunks > 1 {
-			count += refreshChunks
+	// Add chunks for access token if needed
+	accessChunks := calculateChunks(accessToken)
+	if accessChunks > 0 {
+		count += accessChunks
+	}
+
+	// Add chunks for refresh token if needed
+	refreshChunks := calculateChunks(refreshToken)
+	if refreshChunks > 0 {
+		count += refreshChunks
 	}
 
 	return count
-}
+}

settings.go

@@ -10,10 +10,6 @@ import (
 	"strings"
 )
 
-const (
-	cookieName = "_raczylo_oidc"
-)
-
 // Config holds the configuration for the OIDC middleware.
 // It provides all necessary settings to configure OpenID Connect authentication
 // with various providers like Auth0, Logto, or any standard OIDC provider.
@@ -85,30 +81,34 @@ type Config struct {
 	HTTPClient *http.Client
 }
 
-// CreateConfig creates a new Config with sensible default values.
+const (
+	// DefaultRateLimit defines the default rate limit for requests per second
+	DefaultRateLimit = 100
+
+	// MinRateLimit defines the minimum allowed rate limit to prevent DOS
+	MinRateLimit = 10
+
+	// DefaultLogLevel defines the default logging level
+	DefaultLogLevel = "info"
+
+	// MinSessionEncryptionKeyLength defines the minimum length for session encryption key
+	MinSessionEncryptionKeyLength = 32
+)
+
+// CreateConfig creates a new Config with secure default values.
 // Default values are set for optional fields:
 //   - Scopes: ["openid", "profile", "email"]
 //   - LogLevel: "info"
 //   - LogoutURL: CallbackURL + "/logout"
 //   - RateLimit: 100 requests per second
 //   - PostLogoutRedirectURI: "/"
+//   - ForceHTTPS: true (for security)
 func CreateConfig() *Config {
-	c := &Config{}
-
-	if c.Scopes == nil {
-		c.Scopes = []string{"openid", "profile", "email"}
-	}
-
-	if c.LogLevel == "" {
-		c.LogLevel = "info"
-	}
-
-	if c.LogoutURL == "" {
-		c.LogoutURL = c.CallbackURL + "/logout"
-	}
-
-	if c.RateLimit == 0 {
-		c.RateLimit = 100
+	c := &Config{
+		Scopes:     []string{"openid", "profile", "email"},
+		LogLevel:   DefaultLogLevel,
+		RateLimit:  DefaultRateLimit,
+		ForceHTTPS: true, // Secure by default
 	}
 
 	return c
@@ -118,43 +118,85 @@ func CreateConfig() *Config {
 // It ensures all required fields are set and have valid values.
 // Returns an error if any validation check fails.
 func (c *Config) Validate() error {
+	// Validate provider URL
 	if c.ProviderURL == "" {
 		return fmt.Errorf("providerURL is required")
 	}
-	if !isValidURL(c.ProviderURL) {
-		return fmt.Errorf("providerURL must be a valid URL")
+	if !isValidSecureURL(c.ProviderURL) {
+		return fmt.Errorf("providerURL must be a valid HTTPS URL")
 	}
+
+	// Validate callback URL
 	if c.CallbackURL == "" {
 		return fmt.Errorf("callbackURL is required")
 	}
 	if !strings.HasPrefix(c.CallbackURL, "/") {
 		return fmt.Errorf("callbackURL must start with /")
 	}
+
+	// Validate client credentials
 	if c.ClientID == "" {
 		return fmt.Errorf("clientID is required")
 	}
 	if c.ClientSecret == "" {
 		return fmt.Errorf("clientSecret is required")
 	}
+
+	// Validate session encryption key
 	if c.SessionEncryptionKey == "" {
 		return fmt.Errorf("sessionEncryptionKey is required")
 	}
-	if len(c.SessionEncryptionKey) < 32 {
-		return fmt.Errorf("sessionEncryptionKey must be at least 32 characters long")
-	}
-	if c.RateLimit < 0 {
-		return fmt.Errorf("rateLimit must be non-negative")
+	if len(c.SessionEncryptionKey) < MinSessionEncryptionKeyLength {
+		return fmt.Errorf("sessionEncryptionKey must be at least %d characters long", MinSessionEncryptionKeyLength)
 	}
+
+	// Validate log level
 	if c.LogLevel != "" && !isValidLogLevel(c.LogLevel) {
 		return fmt.Errorf("logLevel must be one of: debug, info, error")
 	}
+
+	// Validate excluded URLs
+	for _, url := range c.ExcludedURLs {
+		if !strings.HasPrefix(url, "/") {
+			return fmt.Errorf("excluded URL must start with /: %s", url)
+		}
+		if strings.Contains(url, "..") {
+			return fmt.Errorf("excluded URL must not contain path traversal: %s", url)
+		}
+		if strings.Contains(url, "*") {
+			return fmt.Errorf("excluded URL must not contain wildcards: %s", url)
+		}
+	}
+
+	// Validate revocation URL if set
+	if c.RevocationURL != "" && !isValidSecureURL(c.RevocationURL) {
+		return fmt.Errorf("revocationURL must be a valid HTTPS URL")
+	}
+
+	// Validate end session URL if set
+	if c.OIDCEndSessionURL != "" && !isValidSecureURL(c.OIDCEndSessionURL) {
+		return fmt.Errorf("oidcEndSessionURL must be a valid HTTPS URL")
+	}
+
+	// Validate post-logout redirect URI if set
+	if c.PostLogoutRedirectURI != "" && c.PostLogoutRedirectURI != "/" {
+		if !isValidSecureURL(c.PostLogoutRedirectURI) && !strings.HasPrefix(c.PostLogoutRedirectURI, "/") {
+			return fmt.Errorf("postLogoutRedirectURI must be either a valid HTTPS URL or start with /")
+		}
+	}
+
+	// Validate rate limit
+	if c.RateLimit < MinRateLimit {
+		return fmt.Errorf("rateLimit must be at least %d", MinRateLimit)
+	}
+
 	return nil
 }
 
-// isValidURL checks if the provided string is a valid URL
-func isValidURL(s string) bool {
+// isValidSecureURL checks if the provided string is a valid HTTPS URL
+func isValidSecureURL(s string) bool {
 	u, err := url.Parse(s)
-	return err == nil && u.Scheme != "" && u.Host != ""
+	return err == nil && u.Scheme == "https" && u.Host != ""
 }
 
 // isValidLogLevel checks if the provided log level is valid

settings_test.go

@@ -23,13 +23,18 @@ func TestCreateConfig(t *testing.T) {
 		}
 
 		// Check default log level
-		if config.LogLevel != "info" {
-			t.Errorf("Expected default log level 'info', got '%s'", config.LogLevel)
+		if config.LogLevel != DefaultLogLevel {
+			t.Errorf("Expected default log level '%s', got '%s'", DefaultLogLevel, config.LogLevel)
 		}
 
 		// Check default rate limit
-		if config.RateLimit != 100 {
-			t.Errorf("Expected default rate limit 100, got %d", config.RateLimit)
+		if config.RateLimit != DefaultRateLimit {
+			t.Errorf("Expected default rate limit %d, got %d", DefaultRateLimit, config.RateLimit)
+		}
+
+		// Check ForceHTTPS default
+		if !config.ForceHTTPS {
+			t.Error("Expected ForceHTTPS to be true by default")
 		}
 	})
 
@@ -38,6 +43,7 @@ func TestCreateConfig(t *testing.T) {
 		config.Scopes = []string{"custom_scope"}
 		config.LogLevel = "debug"
 		config.RateLimit = 50
+		config.ForceHTTPS = false
 
 		// Verify custom values are not overwritten
 		if len(config.Scopes) != 1 || config.Scopes[0] != "custom_scope" {
@@ -49,6 +55,9 @@ func TestCreateConfig(t *testing.T) {
 		if config.RateLimit != 50 {
 			t.Error("Custom rate limit was overwritten")
 		}
+		if config.ForceHTTPS {
+			t.Error("Custom ForceHTTPS value was overwritten")
+		}
 	})
 }
 
@@ -98,15 +107,15 @@ func TestConfigValidate(t *testing.T) {
 			expectedError: "sessionEncryptionKey is required",
 		},
 		{
-			name: "Invalid ProviderURL",
+			name: "Non-HTTPS ProviderURL",
 			config: &Config{
-				ProviderURL:          "not-a-url",
+				ProviderURL:          "http://provider.com",
 				CallbackURL:          "/callback",
 				ClientID:             "client-id",
 				ClientSecret:         "client-secret",
 				SessionEncryptionKey: "encryption-key",
 			},
-			expectedError: "providerURL must be a valid URL",
+			expectedError: "providerURL must be a valid HTTPS URL",
 		},
 		{
 			name: "Invalid CallbackURL",
@@ -131,16 +140,16 @@ func TestConfigValidate(t *testing.T) {
 			expectedError: "sessionEncryptionKey must be at least 32 characters long",
 		},
 		{
-			name: "Negative RateLimit",
+			name: "Low RateLimit",
 			config: &Config{
 				ProviderURL:          "https://provider.com",
 				CallbackURL:          "/callback",
 				ClientID:             "client-id",
 				ClientSecret:         "client-secret",
 				SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
-				RateLimit:            -1,
+				RateLimit:            5,
 			},
-			expectedError: "rateLimit must be non-negative",
+			expectedError: "rateLimit must be at least 10",
 		},
 		{
 			name: "Invalid LogLevel",
@@ -154,6 +163,30 @@ func TestConfigValidate(t *testing.T) {
 			},
 			expectedError: "logLevel must be one of: debug, info, error",
 		},
+		{
+			name: "Non-HTTPS RevocationURL",
+			config: &Config{
+				ProviderURL:          "https://provider.com",
+				CallbackURL:          "/callback",
+				ClientID:             "client-id",
+				ClientSecret:         "client-secret",
+				SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
+				RevocationURL:        "http://revoke.com",
+			},
+			expectedError: "revocationURL must be a valid HTTPS URL",
+		},
+		{
+			name: "Non-HTTPS OIDCEndSessionURL",
+			config: &Config{
+				ProviderURL:          "https://provider.com",
+				CallbackURL:          "/callback",
+				ClientID:             "client-id",
+				ClientSecret:         "client-secret",
+				SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
+				OIDCEndSessionURL:    "http://endsession.com",
+			},
+			expectedError: "oidcEndSessionURL must be a valid HTTPS URL",
+		},
 		{
 			name: "Valid Config",
 			config: &Config{
@@ -164,6 +197,8 @@ func TestConfigValidate(t *testing.T) {
 				SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
 				LogLevel:             "debug",
 				RateLimit:            100,
+				RevocationURL:        "https://revoke.com",
+				OIDCEndSessionURL:    "https://endsession.com",
 			},
 			expectedError: "",
 		},
@@ -192,9 +227,9 @@ func TestLogger(t *testing.T) {
 	var debugBuf, infoBuf, errorBuf bytes.Buffer
 
 	tests := []struct {
-		name     string
-		logLevel string
-		testFunc func(*Logger)
+		name      string
+		logLevel  string
+		testFunc  func(*Logger)
 		checkFunc func(t *testing.T, debugOut, infoOut, errorOut string)
 	}{
 		{
@@ -289,7 +324,7 @@ func TestLogger(t *testing.T) {
 			// Create logger with test buffers
 			logger := NewLogger(tc.logLevel)
 			logger.logError.SetOutput(&errorBuf)
-			
+
 			if tc.logLevel == "debug" || tc.logLevel == "info" {
 				logger.logInfo.SetOutput(&infoBuf)
 			}