Merge origin/main into release-0.7.4

Resolved conflicts by keeping refactored structure from release-0.7.4 where functions have been moved to their respective modules (auth_flow.go, token_manager.go, utilities.go)

auth_flow.go

@@ -0,0 +1,336 @@
+package traefikoidc
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/google/uuid"
+)
+
+// ============================================================================
+// AUTHENTICATION FLOW
+// ============================================================================
+
+// validateRedirectCount checks if redirect limit is exceeded and handles the error
+func (t *TraefikOidc) validateRedirectCount(session *SessionData, rw http.ResponseWriter, req *http.Request) error {
+	const maxRedirects = 5
+	redirectCount := session.GetRedirectCount()
+	if redirectCount >= maxRedirects {
+		t.logger.Errorf("Maximum redirect limit (%d) exceeded, possible redirect loop detected", maxRedirects)
+		session.ResetRedirectCount()
+		t.sendErrorResponse(rw, req, "Authentication failed: Too many redirects", http.StatusLoopDetected)
+		return fmt.Errorf("redirect limit exceeded")
+	}
+
+	session.IncrementRedirectCount()
+	return nil
+}
+
+// generatePKCEParameters generates PKCE code verifier and challenge if PKCE is enabled
+func (t *TraefikOidc) generatePKCEParameters() (string, string, error) {
+	if !t.enablePKCE {
+		return "", "", nil
+	}
+
+	codeVerifier, err := generateCodeVerifier()
+	if err != nil {
+		return "", "", fmt.Errorf("failed to generate code verifier: %w", err)
+	}
+
+	codeChallenge := deriveCodeChallenge(codeVerifier)
+	t.logger.Debugf("PKCE enabled, generated code challenge")
+
+	return codeVerifier, codeChallenge, nil
+}
+
+// prepareSessionForAuthentication clears existing session data and sets new authentication state
+func (t *TraefikOidc) prepareSessionForAuthentication(session *SessionData, csrfToken, nonce, codeVerifier, incomingPath string) {
+	// Clear all existing session data
+	session.SetAuthenticated(false)
+	session.SetEmail("")
+	session.SetAccessToken("")
+	session.SetRefreshToken("")
+	session.SetIDToken("")
+	session.SetNonce("")
+	session.SetCodeVerifier("")
+
+	// Set new authentication state
+	session.SetCSRF(csrfToken)
+	session.SetNonce(nonce)
+	if t.enablePKCE && codeVerifier != "" {
+		session.SetCodeVerifier(codeVerifier)
+	}
+	session.SetIncomingPath(incomingPath)
+	t.logger.Debugf("Storing incoming path: %s", incomingPath)
+}
+
+// defaultInitiateAuthentication initiates the OIDC authentication flow.
+// It generates CSRF tokens, nonce, PKCE parameters (if enabled), clears the session,
+// stores authentication state, and redirects the user to the OIDC provider.
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The HTTP request initiating authentication.
+//   - session: The session data to prepare for authentication.
+//   - redirectURL: The pre-calculated callback URL (redirect_uri) for this middleware instance.
+func (t *TraefikOidc) defaultInitiateAuthentication(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) {
+	t.logger.Debugf("Initiating new OIDC authentication flow for request: %s", req.URL.RequestURI())
+
+	// Check and handle redirect limits
+	if err := t.validateRedirectCount(session, rw, req); err != nil {
+		return
+	}
+
+	csrfToken := uuid.NewString()
+	nonce, err := generateNonce()
+	if err != nil {
+		t.logger.Errorf("Failed to generate nonce: %v", err)
+		http.Error(rw, "Failed to generate nonce", http.StatusInternalServerError)
+		return
+	}
+
+	// Generate PKCE parameters if enabled
+	codeVerifier, codeChallenge, err := t.generatePKCEParameters()
+	if err != nil {
+		t.logger.Errorf("Failed to generate PKCE parameters: %v", err)
+		http.Error(rw, "Failed to generate PKCE parameters", http.StatusInternalServerError)
+		return
+	}
+
+	// Clear existing session data and set new authentication state
+	t.prepareSessionForAuthentication(session, csrfToken, nonce, codeVerifier, req.URL.RequestURI())
+
+	session.MarkDirty()
+
+	if err := session.Save(req, rw); err != nil {
+		t.logger.Errorf("Failed to save session before redirecting to provider: %v", err)
+		http.Error(rw, "Failed to save session", http.StatusInternalServerError)
+		return
+	}
+
+	t.logger.Debugf("Session saved before redirect. CSRF: %s, Nonce: %s",
+		csrfToken, nonce)
+
+	authURL := t.buildAuthURL(redirectURL, csrfToken, nonce, codeChallenge)
+	t.logger.Debugf("Redirecting user to OIDC provider: %s", authURL)
+
+	http.Redirect(rw, req, authURL, http.StatusFound)
+}
+
+// handleCallback processes the OIDC callback after user authentication.
+// It validates state/CSRF tokens, exchanges authorization code for tokens,
+// verifies the received tokens, extracts claims, and establishes the session.
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The callback request containing authorization code and state.
+//   - redirectURL: The fully qualified callback URL (used in the token exchange request).
+func (t *TraefikOidc) handleCallback(rw http.ResponseWriter, req *http.Request, redirectURL string) {
+	session, err := t.sessionManager.GetSession(req)
+	if err != nil {
+		t.logger.Errorf("Session error during callback: %v", err)
+		t.sendErrorResponse(rw, req, "Session error during callback", http.StatusInternalServerError)
+		return
+	}
+	defer session.returnToPoolSafely()
+
+	t.logger.Debugf("Handling callback, URL: %s", req.URL.String())
+
+	if req.URL.Query().Get("error") != "" {
+		errorDescription := req.URL.Query().Get("error_description")
+		if errorDescription == "" {
+			errorDescription = req.URL.Query().Get("error")
+		}
+		t.logger.Errorf("Authentication error from provider during callback: %s - %s", req.URL.Query().Get("error"), errorDescription)
+		t.sendErrorResponse(rw, req, fmt.Sprintf("Authentication error from provider: %s", errorDescription), http.StatusBadRequest)
+		return
+	}
+
+	state := req.URL.Query().Get("state")
+	if state == "" {
+		t.logger.Error("No state in callback")
+		t.sendErrorResponse(rw, req, "State parameter missing in callback", http.StatusBadRequest)
+		return
+	}
+
+	csrfToken := session.GetCSRF()
+	if csrfToken == "" {
+		t.logger.Errorf("CSRF token missing in session during callback. Authenticated: %v, Request URL: %s",
+			session.GetAuthenticated(), req.URL.String())
+
+		cookie, err := req.Cookie("_oidc_raczylo_m")
+		if err != nil {
+			t.logger.Errorf("Main session cookie not found in request: %v", err)
+		} else {
+			t.logger.Errorf("Main session cookie exists but CSRF token is empty. Cookie value length: %d", len(cookie.Value))
+		}
+
+		t.sendErrorResponse(rw, req, "CSRF token missing in session", http.StatusBadRequest)
+		return
+	}
+
+	if state != csrfToken {
+		t.logger.Error("State parameter does not match CSRF token in session during callback")
+		t.sendErrorResponse(rw, req, "Invalid state parameter (CSRF mismatch)", http.StatusBadRequest)
+		return
+	}
+
+	code := req.URL.Query().Get("code")
+	if code == "" {
+		t.logger.Error("No code in callback")
+		t.sendErrorResponse(rw, req, "No authorization code received in callback", http.StatusBadRequest)
+		return
+	}
+
+	codeVerifier := session.GetCodeVerifier()
+
+	tokenResponse, err := t.tokenExchanger.ExchangeCodeForToken(req.Context(), "authorization_code", code, redirectURL, codeVerifier)
+	if err != nil {
+		t.logger.Errorf("Failed to exchange code for token during callback: %v", err)
+		t.sendErrorResponse(rw, req, "Authentication failed: Could not exchange code for token", http.StatusInternalServerError)
+		return
+	}
+
+	if err = t.verifyToken(tokenResponse.IDToken); err != nil {
+		t.logger.Errorf("Failed to verify id_token during callback: %v", err)
+		t.sendErrorResponse(rw, req, "Authentication failed: Could not verify ID token", http.StatusInternalServerError)
+		return
+	}
+
+	claims, err := t.extractClaimsFunc(tokenResponse.IDToken)
+	if err != nil {
+		t.logger.Errorf("Failed to extract claims during callback: %v", err)
+		t.sendErrorResponse(rw, req, "Authentication failed: Could not extract claims from token", http.StatusInternalServerError)
+		return
+	}
+
+	nonceClaim, ok := claims["nonce"].(string)
+	if !ok || nonceClaim == "" {
+		t.logger.Error("Nonce claim missing in id_token during callback")
+		t.sendErrorResponse(rw, req, "Authentication failed: Nonce missing in token", http.StatusInternalServerError)
+		return
+	}
+
+	sessionNonce := session.GetNonce()
+	if sessionNonce == "" {
+		t.logger.Error("Nonce not found in session during callback")
+		t.sendErrorResponse(rw, req, "Authentication failed: Nonce missing in session", http.StatusInternalServerError)
+		return
+	}
+
+	if nonceClaim != sessionNonce {
+		t.logger.Error("Nonce claim does not match session nonce during callback")
+		t.sendErrorResponse(rw, req, "Authentication failed: Nonce mismatch", http.StatusInternalServerError)
+		return
+	}
+
+	email, _ := claims["email"].(string)
+	if email == "" {
+		t.logger.Errorf("Email claim missing or empty in token during callback")
+		t.sendErrorResponse(rw, req, "Authentication failed: Email missing in token", http.StatusInternalServerError)
+		return
+	}
+	if !t.isAllowedDomain(email) {
+		t.logger.Errorf("Disallowed email domain during callback: %s", email)
+		t.sendErrorResponse(rw, req, "Authentication failed: Email domain not allowed", http.StatusForbidden)
+		return
+	}
+
+	if err := session.SetAuthenticated(true); err != nil {
+		t.logger.Errorf("Failed to set authenticated state and regenerate session ID: %v", err)
+		t.sendErrorResponse(rw, req, "Failed to update session", http.StatusInternalServerError)
+		return
+	}
+	session.SetEmail(email)
+	session.SetIDToken(tokenResponse.IDToken)
+	session.SetAccessToken(tokenResponse.AccessToken)
+	session.SetRefreshToken(tokenResponse.RefreshToken)
+
+	session.SetCSRF("")
+	session.SetNonce("")
+	session.SetCodeVerifier("")
+
+	session.ResetRedirectCount()
+
+	redirectPath := "/"
+	if incomingPath := session.GetIncomingPath(); incomingPath != "" && incomingPath != t.redirURLPath {
+		redirectPath = incomingPath
+	}
+	session.SetIncomingPath("")
+
+	if err := session.Save(req, rw); err != nil {
+		t.logger.Errorf("Failed to save session after callback: %v", err)
+		t.sendErrorResponse(rw, req, "Failed to save session after callback", http.StatusInternalServerError)
+		return
+	}
+
+	t.logger.Debugf("Callback successful, redirecting to %s", redirectPath)
+	http.Redirect(rw, req, redirectPath, http.StatusFound)
+}
+
+// handleExpiredToken handles requests with expired or invalid tokens.
+// It clears the session data and initiates a new authentication flow.
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The HTTP request with expired token.
+//   - session: The session data to clear.
+//   - redirectURL: The callback URL to be used in the new authentication flow.
+func (t *TraefikOidc) handleExpiredToken(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) {
+	t.logger.Debug("Handling expired token: Clearing session and initiating re-authentication.")
+	session.SetAuthenticated(false)
+	session.SetIDToken("")
+	session.SetAccessToken("")
+	session.SetRefreshToken("")
+	session.SetEmail("")
+	// Clear CSRF tokens to prevent replay attacks
+	session.SetCSRF("")
+	session.SetNonce("")
+	session.SetCodeVerifier("")
+	// Reset redirect count to prevent loops when handling expired tokens
+	session.ResetRedirectCount()
+
+	if err := session.Save(req, rw); err != nil {
+		t.logger.Errorf("Failed to save cleared session during expired token handling: %v", err)
+	}
+
+	t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+}
+
+// isUserAuthenticated determines the authentication status and refresh requirements.
+// It delegates to provider-specific validation methods that handle different token types
+// and expiration behaviors.
+// Parameters:
+//   - session: The session data containing authentication tokens.
+//
+// Returns:
+//   - authenticated (bool): True if the user has valid tokens.
+//   - needsRefresh (bool): True if tokens are valid but nearing expiration.
+//   - expired (bool): True if the session is unauthenticated, the token is missing,
+//     or the token verification failed for reasons other than nearing/actual expiration.
+func (t *TraefikOidc) isUserAuthenticated(session *SessionData) (bool, bool, bool) {
+	if t.isAzureProvider() {
+		return t.validateAzureTokens(session)
+	} else if t.isGoogleProvider() {
+		return t.validateGoogleTokens(session)
+	}
+	// Auth0 and other providers can now use standard validation
+	// which handles opaque tokens generically
+	return t.validateStandardTokens(session)
+}
+
+// isAjaxRequest determines if this is an AJAX request that should receive 401 instead of redirect
+func (t *TraefikOidc) isAjaxRequest(req *http.Request) bool {
+	xhr := req.Header.Get("X-Requested-With")
+	contentType := req.Header.Get("Content-Type")
+	accept := req.Header.Get("Accept")
+
+	return xhr == "XMLHttpRequest" ||
+		strings.Contains(contentType, "application/json") ||
+		strings.Contains(accept, "application/json")
+}
+
+// isRefreshTokenExpired checks if refresh token is likely expired (older than 6 hours)
+func (t *TraefikOidc) isRefreshTokenExpired(session *SessionData) bool {
+	// This is a heuristic check - actual implementation would depend on
+	// the specific provider and token metadata
+	return false // Placeholder implementation
+}

autocleanup.go

@@ -173,7 +173,7 @@ func (bt *BackgroundTask) run() {
 
 	if bt.logger != nil {
 		if !isTestMode() {
-			bt.logger.Info("Starting background task: %s", bt.name)
+			bt.logger.Debug("Starting background task: %s", bt.name)
 		}
 	}
 
@@ -182,7 +182,7 @@ func (bt *BackgroundTask) run() {
 	case <-bt.stopChan:
 		if bt.logger != nil {
 			if !isTestMode() {
-				bt.logger.Info("Stopping background task: %s (before initial execution)", bt.name)
+				bt.logger.Debug("Stopping background task: %s (before initial execution)", bt.name)
 			}
 		}
 		return
@@ -201,7 +201,7 @@ func (bt *BackgroundTask) run() {
 			case <-bt.stopChan:
 				if bt.logger != nil {
 					if !isTestMode() {
-						bt.logger.Info("Stopping background task: %s (during periodic execution)", bt.name)
+						bt.logger.Debug("Stopping background task: %s (during periodic execution)", bt.name)
 					}
 				}
 				return
@@ -211,7 +211,7 @@ func (bt *BackgroundTask) run() {
 		case <-bt.stopChan:
 			if bt.logger != nil {
 				if !isTestMode() {
-					bt.logger.Info("Stopping background task: %s (direct stop signal)", bt.name)
+					bt.logger.Debug("Stopping background task: %s (direct stop signal)", bt.name)
 				}
 			}
 			return
@@ -315,7 +315,7 @@ func (cb *TaskCircuitBreaker) CanCreateTask(taskName string) error {
 		if time.Now().Unix()-lastFailure > int64(cb.timeout.Seconds()) {
 			atomic.StoreInt32(&cb.state, int32(CircuitBreakerHalfOpen))
 			if cb.logger != nil {
-				cb.logger.Info("Circuit breaker transitioning to half-open for task: %s", taskName)
+				cb.logger.Debug("Circuit breaker transitioning to half-open for task: %s", taskName)
 			}
 			return nil
 		}
@@ -467,7 +467,7 @@ func (tr *TaskRegistry) RegisterTask(name string, task *BackgroundTask) error {
 	tr.cb.OnTaskSuccess(name)
 
 	if tr.logger != nil {
-		tr.logger.Info("Registered background task: %s", name)
+		tr.logger.Debug("Registered background task: %s", name)
 	}
 
 	return nil
@@ -483,7 +483,7 @@ func (tr *TaskRegistry) UnregisterTask(name string) {
 		delete(tr.tasks, name)
 
 		if tr.logger != nil {
-			tr.logger.Info("Unregistered background task: %s", name)
+			tr.logger.Debug("Unregistered background task: %s", name)
 		}
 	}
 }
@@ -513,7 +513,7 @@ func (tr *TaskRegistry) StopAllTasks() {
 	for name, task := range tasksCopy {
 		task.Stop()
 		if tr.logger != nil {
-			tr.logger.Info("Stopped background task during shutdown: %s", name)
+			tr.logger.Debug("Stopped background task during shutdown: %s", name)
 		}
 	}
 }
@@ -641,7 +641,7 @@ func (mm *TaskMemoryMonitor) Start(interval time.Duration) error {
 	mm.started = true
 
 	if mm.logger != nil && !isTestMode() {
-		mm.logger.Info("Started global task memory monitoring with %v interval", interval)
+		mm.logger.Debug("Started global task memory monitoring with %v interval", interval)
 	}
 
 	return nil

autocleanup_additional_test.go

@@ -0,0 +1,224 @@
+package traefikoidc
+
+import (
+	"errors"
+	"sync"
+	"testing"
+	"time"
+)
+
+// globalRegistryMutex protects only the global registry operations
+var globalRegistryMutex sync.Mutex
+
+// TestTaskCircuitBreakerOnTaskFailure tests the OnTaskFailure method
+func TestTaskCircuitBreakerOnTaskFailure(t *testing.T) {
+	logger := NewLogger("debug") // Create a real logger
+	cb := NewTaskCircuitBreaker(3, time.Minute, logger)
+
+	// Test failure doesn't trigger open state before threshold
+	cb.OnTaskFailure("test-task", errors.New("test error"))
+	if err := cb.CanCreateTask("test-task"); err != nil {
+		t.Error("Circuit breaker should allow task creation after 1 failure (threshold: 3)")
+	}
+
+	// Test failure count reaches threshold and opens circuit
+	cb.OnTaskFailure("test-task", errors.New("test error 2"))
+	cb.OnTaskFailure("test-task", errors.New("test error 3"))
+
+	if err := cb.CanCreateTask("test-task"); err == nil {
+		t.Error("Circuit breaker should prevent task creation after reaching failure threshold")
+	}
+}
+
+// TestResetGlobalTaskRegistry tests the reset functionality
+func TestResetGlobalTaskRegistry(t *testing.T) {
+	globalRegistryMutex.Lock()
+	defer globalRegistryMutex.Unlock()
+
+	// Get the global registry first
+	registry := GetGlobalTaskRegistry()
+
+	// Create and register a dummy task
+	logger := NewLogger("debug")
+	task := NewBackgroundTask("test-task", time.Second, func() {
+		// Do nothing
+	}, logger)
+
+	registry.RegisterTask("test-task", task)
+
+	// Verify task is registered
+	if registry.GetTaskCount() == 0 {
+		t.Error("Expected task to be registered")
+	}
+
+	// Reset the registry
+	ResetGlobalTaskRegistry()
+
+	// Get registry again and verify it's empty
+	newRegistry := GetGlobalTaskRegistry()
+	if newRegistry.GetTaskCount() != 0 {
+		t.Error("Expected registry to be empty after reset")
+	}
+}
+
+// TestGetTask tests the GetTask method
+func TestGetTask(t *testing.T) {
+	globalRegistryMutex.Lock()
+	defer globalRegistryMutex.Unlock()
+
+	// Reset registry to ensure clean state
+	ResetGlobalTaskRegistry()
+	registry := GetGlobalTaskRegistry()
+
+	// Test getting non-existent task
+	task, exists := registry.GetTask("non-existent")
+	if task != nil || exists {
+		t.Error("Expected nil and false for non-existent task")
+	}
+
+	// Create and register a task
+	logger := NewLogger("debug")
+	newTask := NewBackgroundTask("test-task", time.Second, func() {
+		// Do nothing
+	}, logger)
+
+	registry.RegisterTask("test-task", newTask)
+
+	// Test getting existing task
+	retrievedTask, exists := registry.GetTask("test-task")
+	if retrievedTask == nil || !exists {
+		t.Error("Expected to retrieve registered task")
+		return
+	}
+
+	if retrievedTask.name != "test-task" {
+		t.Errorf("Expected task name 'test-task', got '%s'", retrievedTask.name)
+	}
+}
+
+// TestNewTaskMemoryMonitor tests the NewTaskMemoryMonitor function
+func TestNewTaskMemoryMonitor(t *testing.T) {
+	// No mutex needed - this doesn't modify global state
+	logger := NewLogger("debug")
+	registry := GetGlobalTaskRegistry()
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	if monitor == nil {
+		t.Error("Expected NewTaskMemoryMonitor to return non-nil monitor")
+	}
+}
+
+// TestGetCurrentStats tests the GetCurrentStats method
+func TestGetCurrentStats(t *testing.T) {
+	// Don't hold mutex during background task execution to avoid deadlocks
+	logger := NewLogger("debug")
+	registry := GetGlobalTaskRegistry()
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	// Start the monitor and let it collect at least one statistic
+	err := monitor.Start(50 * time.Millisecond)
+	if err != nil {
+		t.Fatalf("Failed to start monitor: %v", err)
+	}
+
+	// Ensure monitor is stopped even if test fails
+	defer func() {
+		monitor.Stop()
+		// Give extra time for cleanup
+		time.Sleep(50 * time.Millisecond)
+	}()
+
+	// Wait a bit for the monitor to collect stats
+	time.Sleep(150 * time.Millisecond)
+
+	stats, err := monitor.GetCurrentStats()
+	if err != nil {
+		// If no stats are available yet, that's acceptable for this test
+		t.Logf("No memory statistics available yet: %v", err)
+		return
+	}
+
+	// TaskMemoryStats is a struct, not a pointer, so it can't be nil
+	if stats.Timestamp.IsZero() {
+		t.Error("Expected GetCurrentStats to return valid timestamp")
+	}
+}
+
+// TestGetStatsHistory tests the GetStatsHistory method
+func TestGetStatsHistory(t *testing.T) {
+	// No mutex needed - this just creates a monitor and checks its initial state
+	logger := NewLogger("debug")
+	registry := GetGlobalTaskRegistry()
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	history := monitor.GetStatsHistory()
+	if history == nil {
+		t.Error("Expected GetStatsHistory to return non-nil history")
+	}
+
+	// A fresh monitor should have empty history
+	if len(history) != 0 {
+		t.Logf("History length: %d (may be non-empty due to shared global state)", len(history))
+	}
+}
+
+// TestForceGC tests the ForceGC method
+func TestForceGC(t *testing.T) {
+	// No mutex needed - this doesn't modify global state
+	logger := NewLogger("debug")
+	registry := GetGlobalTaskRegistry()
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	// This should not panic and should work
+	monitor.ForceGC()
+	// No specific verification needed, just ensuring it doesn't crash
+}
+
+// TestShutdownAllTasks tests the ShutdownAllTasks function
+func TestShutdownAllTasks(t *testing.T) {
+	// Use a unique task name prefix to avoid conflicts with other tests
+	taskPrefix := "shutdown-test-"
+
+	// Create a temporary clean registry state
+	func() {
+		globalRegistryMutex.Lock()
+		defer globalRegistryMutex.Unlock()
+		ResetGlobalTaskRegistry()
+	}()
+
+	registry := GetGlobalTaskRegistry()
+	logger := NewLogger("debug")
+
+	// Create some test tasks with unique names
+	task1 := NewBackgroundTask(taskPrefix+"task1", time.Millisecond, func() {
+		time.Sleep(100 * time.Millisecond) // Simulate work
+	}, logger)
+
+	task2 := NewBackgroundTask(taskPrefix+"task2", time.Millisecond, func() {
+		time.Sleep(100 * time.Millisecond) // Simulate work
+	}, logger)
+
+	// Register tasks under mutex protection
+	func() {
+		globalRegistryMutex.Lock()
+		defer globalRegistryMutex.Unlock()
+		registry.RegisterTask(taskPrefix+"task1", task1)
+		registry.RegisterTask(taskPrefix+"task2", task2)
+	}()
+
+	// Start the tasks (outside mutex to avoid deadlock)
+	task1.Start()
+	task2.Start()
+
+	// Give tasks time to start
+	time.Sleep(50 * time.Millisecond)
+
+	// Shutdown all tasks
+	ShutdownAllTasks()
+
+	// Give shutdown time to complete
+	time.Sleep(200 * time.Millisecond)
+
+	// Note: We can't reliably verify task count due to other tests
+	// Just ensure shutdown doesn't panic
+}

config/config_test.go

@@ -2,6 +2,10 @@
 package config
 
 import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
 	"testing"
 )
 
@@ -248,3 +252,757 @@ func TestConstants(t *testing.T) {
 		t.Errorf("Expected ConstSessionTimeout 86400, got %d", ConstSessionTimeout)
 	}
 }
+
+func TestCreateDefaultSecurityConfig(t *testing.T) {
+	config := createDefaultSecurityConfig()
+
+	if config == nil {
+		t.Fatal("createDefaultSecurityConfig() returned nil")
+	}
+
+	// Test default values
+	if !config.Enabled {
+		t.Error("Expected Enabled to be true")
+	}
+
+	if config.Profile != "default" {
+		t.Errorf("Expected Profile 'default', got '%s'", config.Profile)
+	}
+
+	if !config.StrictTransportSecurity {
+		t.Error("Expected StrictTransportSecurity to be true")
+	}
+
+	if config.StrictTransportSecurityMaxAge != 31536000 {
+		t.Errorf("Expected StrictTransportSecurityMaxAge 31536000, got %d", config.StrictTransportSecurityMaxAge)
+	}
+
+	if config.FrameOptions != "DENY" {
+		t.Errorf("Expected FrameOptions 'DENY', got '%s'", config.FrameOptions)
+	}
+
+	if config.ContentTypeOptions != "nosniff" {
+		t.Errorf("Expected ContentTypeOptions 'nosniff', got '%s'", config.ContentTypeOptions)
+	}
+
+	if config.XSSProtection != "1; mode=block" {
+		t.Errorf("Expected XSSProtection '1; mode=block', got '%s'", config.XSSProtection)
+	}
+
+	if config.CORSEnabled {
+		t.Error("Expected CORSEnabled to be false")
+	}
+
+	if !config.DisableServerHeader {
+		t.Error("Expected DisableServerHeader to be true")
+	}
+}
+
+func TestToInternalSecurityConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   *SecurityHeadersConfig
+		expected map[string]interface{}
+	}{
+		{
+			name:     "nil config",
+			config:   nil,
+			expected: nil,
+		},
+		{
+			name: "disabled config",
+			config: &SecurityHeadersConfig{
+				Enabled: false,
+			},
+			expected: nil,
+		},
+		{
+			name: "default profile",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "default",
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":       false,
+				"ContentSecurityPolicy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';",
+				"FrameOptions":          "DENY",
+			},
+		},
+		{
+			name: "strict profile",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "strict",
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":       false,
+				"ContentSecurityPolicy": "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';",
+			},
+		},
+		{
+			name: "development profile",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "development",
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode": true,
+				"FrameOptions":    "SAMEORIGIN",
+			},
+		},
+		{
+			name: "api profile",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "api",
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":       false,
+				"ContentSecurityPolicy": "default-src 'none'; frame-ancestors 'none';",
+				"FrameOptions":          "DENY",
+			},
+		},
+		{
+			name: "custom config with overrides",
+			config: &SecurityHeadersConfig{
+				Enabled:                       true,
+				Profile:                       "custom",
+				ContentSecurityPolicy:         "custom-csp",
+				FrameOptions:                  "SAMEORIGIN",
+				StrictTransportSecurity:       true,
+				StrictTransportSecurityMaxAge: 86400,
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":               false,
+				"ContentSecurityPolicy":         "custom-csp",
+				"FrameOptions":                  "SAMEORIGIN",
+				"StrictTransportSecurityMaxAge": 86400,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.ToInternalSecurityConfig()
+
+			if tt.expected == nil {
+				if result != nil {
+					t.Errorf("Expected nil result, got %v", result)
+				}
+				return
+			}
+
+			if result == nil {
+				t.Fatal("Expected non-nil result")
+			}
+
+			configMap, ok := result.(map[string]interface{})
+			if !ok {
+				t.Fatalf("Expected map[string]interface{}, got %T", result)
+			}
+
+			// Check a few key values
+			for key, expectedValue := range tt.expected {
+				if actualValue, exists := configMap[key]; !exists {
+					t.Errorf("Expected key '%s' not found", key)
+				} else if actualValue != expectedValue {
+					t.Errorf("For key '%s': expected %v, got %v", key, expectedValue, actualValue)
+				}
+			}
+		})
+	}
+}
+
+func TestGetSecurityHeadersApplier(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   *Config
+		expected bool // whether applier should be nil
+	}{
+		{
+			name: "nil security headers",
+			config: &Config{
+				SecurityHeaders: nil,
+			},
+			expected: true, // applier should be nil
+		},
+		{
+			name: "disabled security headers",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled: false,
+				},
+			},
+			expected: true, // applier should be nil
+		},
+		{
+			name: "enabled security headers",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled: true,
+				},
+			},
+			expected: false, // applier should not be nil
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			applier := tt.config.GetSecurityHeadersApplier()
+
+			if tt.expected && applier != nil {
+				t.Error("Expected applier to be nil")
+			}
+			if !tt.expected && applier == nil {
+				t.Error("Expected applier to not be nil")
+			}
+		})
+	}
+}
+
+func TestIsOriginAllowed(t *testing.T) {
+	tests := []struct {
+		name           string
+		origin         string
+		allowedOrigins []string
+		expected       bool
+	}{
+		{
+			name:           "exact match",
+			origin:         "https://example.com",
+			allowedOrigins: []string{"https://example.com", "https://other.com"},
+			expected:       true,
+		},
+		{
+			name:           "wildcard match",
+			origin:         "https://test.example.com",
+			allowedOrigins: []string{"https://*.example.com"},
+			expected:       true,
+		},
+		{
+			name:           "root domain match with wildcard",
+			origin:         "https://example.com",
+			allowedOrigins: []string{"https://*.example.com"},
+			expected:       true,
+		},
+		{
+			name:           "http wildcard match",
+			origin:         "http://test.example.com",
+			allowedOrigins: []string{"http://*.example.com"},
+			expected:       true,
+		},
+		{
+			name:           "catch-all wildcard",
+			origin:         "https://anything.com",
+			allowedOrigins: []string{"*"},
+			expected:       true,
+		},
+		{
+			name:           "no match",
+			origin:         "https://notallowed.com",
+			allowedOrigins: []string{"https://example.com"},
+			expected:       false,
+		},
+		{
+			name:           "empty allowed origins",
+			origin:         "https://example.com",
+			allowedOrigins: []string{},
+			expected:       false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isOriginAllowed(tt.origin, tt.allowedOrigins)
+			if result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestSecurityHeadersConfigValidation(t *testing.T) {
+	tests := []struct {
+		name   string
+		config *SecurityHeadersConfig
+		valid  bool
+	}{
+		{
+			name: "valid default config",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "default",
+			},
+			valid: true,
+		},
+		{
+			name: "valid strict config",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "strict",
+			},
+			valid: true,
+		},
+		{
+			name: "valid development config",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "development",
+			},
+			valid: true,
+		},
+		{
+			name: "valid api config",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "api",
+			},
+			valid: true,
+		},
+		{
+			name: "valid custom config",
+			config: &SecurityHeadersConfig{
+				Enabled:               true,
+				Profile:               "custom",
+				ContentSecurityPolicy: "default-src 'self'",
+			},
+			valid: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Basic validation - ensure config can be processed
+			if tt.config == nil && tt.valid {
+				t.Error("Expected valid config, got nil")
+			}
+
+			// Test ToInternalSecurityConfig doesn't panic
+			result := tt.config.ToInternalSecurityConfig()
+
+			if tt.config.Enabled && result == nil {
+				t.Error("Expected non-nil result for enabled config")
+			}
+		})
+	}
+}
+
+func TestConfigWithSecurityHeaders(t *testing.T) {
+	config := CreateConfig()
+
+	// Test that default config has security headers
+	if config.SecurityHeaders == nil {
+		t.Fatal("Expected SecurityHeaders to be initialized")
+	}
+
+	if !config.SecurityHeaders.Enabled {
+		t.Error("Expected SecurityHeaders to be enabled by default")
+	}
+
+	// Test security headers applier
+	applier := config.GetSecurityHeadersApplier()
+	if applier == nil {
+		t.Error("Expected security headers applier to be non-nil")
+	}
+
+	// Test with custom security config
+	config.SecurityHeaders = &SecurityHeadersConfig{
+		Enabled:                       true,
+		Profile:                       "strict",
+		ContentSecurityPolicy:         "default-src 'self'",
+		FrameOptions:                  "DENY",
+		StrictTransportSecurity:       true,
+		StrictTransportSecurityMaxAge: 31536000,
+		CORSEnabled:                   false,
+		CustomHeaders:                 map[string]string{"X-Custom": "value"},
+	}
+
+	applier = config.GetSecurityHeadersApplier()
+	if applier == nil {
+		t.Error("Expected custom security headers applier to be non-nil")
+	}
+}
+
+func TestConfigEdgeCases(t *testing.T) {
+	// Test config with empty values
+	config := &Config{
+		ProviderURL:  "",
+		ClientID:     "",
+		ClientSecret: "",
+		LogLevel:     "",
+		Scopes:       []string{},
+		Headers:      []HeaderConfig{},
+	}
+
+	if config.LogLevel != "" {
+		t.Errorf("Expected empty LogLevel, got '%s'", config.LogLevel)
+	}
+
+	if len(config.Scopes) != 0 {
+		t.Errorf("Expected empty Scopes, got %d", len(config.Scopes))
+	}
+
+	// Test config with nil slices
+	config = &Config{
+		Scopes:  nil,
+		Headers: nil,
+	}
+
+	if len(config.Scopes) != 0 {
+		t.Errorf("Expected empty Scopes, got %v", config.Scopes)
+	}
+}
+
+func TestSecurityHeadersApplierComprehensive(t *testing.T) {
+	tests := []struct {
+		name   string
+		config *Config
+		setup  func(*http.Request) *http.Request
+		check  func(*testing.T, http.Header)
+	}{
+		{
+			name: "All security headers with HTTPS",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled:                           true,
+					FrameOptions:                      "SAMEORIGIN",
+					ContentTypeOptions:                "nosniff",
+					XSSProtection:                     "1; mode=block",
+					ReferrerPolicy:                    "strict-origin-when-cross-origin",
+					ContentSecurityPolicy:             "default-src 'self'",
+					StrictTransportSecurity:           true,
+					StrictTransportSecurityMaxAge:     31536000,
+					StrictTransportSecuritySubdomains: true,
+					StrictTransportSecurityPreload:    true,
+					CORSEnabled:                       true,
+					CORSAllowedOrigins:                []string{"https://example.com"},
+					CORSAllowedMethods:                []string{"GET", "POST"},
+					CORSAllowedHeaders:                []string{"Authorization", "Content-Type"},
+					CORSAllowCredentials:              true,
+					CORSMaxAge:                        86400,
+					CustomHeaders:                     map[string]string{"X-Custom": "value"},
+					DisableServerHeader:               true,
+					DisablePoweredByHeader:            true,
+				},
+			},
+			setup: func(req *http.Request) *http.Request {
+				req.Header.Set("Origin", "https://example.com")
+				req.Header.Set("X-Forwarded-Proto", "https")
+				return req
+			},
+			check: func(t *testing.T, headers http.Header) {
+				expectedHeaders := map[string]string{
+					"X-Frame-Options":                  "SAMEORIGIN",
+					"X-Content-Type-Options":           "nosniff",
+					"X-XSS-Protection":                 "1; mode=block",
+					"Referrer-Policy":                  "strict-origin-when-cross-origin",
+					"Content-Security-Policy":          "default-src 'self'",
+					"Strict-Transport-Security":        "max-age=31536000; includeSubDomains; preload",
+					"Access-Control-Allow-Origin":      "https://example.com",
+					"Access-Control-Allow-Methods":     "GET, POST",
+					"Access-Control-Allow-Headers":     "Authorization, Content-Type",
+					"Access-Control-Allow-Credentials": "true",
+					"Access-Control-Max-Age":           "86400",
+					"X-Custom":                         "value",
+				}
+
+				for key, expected := range expectedHeaders {
+					if actual := headers.Get(key); actual != expected {
+						t.Errorf("Expected header %s: '%s', got '%s'", key, expected, actual)
+					}
+				}
+			},
+		},
+		{
+			name: "CORS with wildcard origin",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled:            true,
+					CORSEnabled:        true,
+					CORSAllowedOrigins: []string{"*"},
+				},
+			},
+			setup: func(req *http.Request) *http.Request {
+				req.Header.Set("Origin", "https://anywhere.com")
+				return req
+			},
+			check: func(t *testing.T, headers http.Header) {
+				if origin := headers.Get("Access-Control-Allow-Origin"); origin != "https://anywhere.com" {
+					t.Errorf("Expected CORS origin 'https://anywhere.com', got '%s'", origin)
+				}
+			},
+		},
+		{
+			name: "HSTS with TLS",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled:                        true,
+					StrictTransportSecurity:        true,
+					StrictTransportSecurityMaxAge:  63072000,
+					StrictTransportSecurityPreload: false,
+				},
+			},
+			setup: func(req *http.Request) *http.Request {
+				// Simulate TLS request
+				req.TLS = &tls.ConnectionState{}
+				return req
+			},
+			check: func(t *testing.T, headers http.Header) {
+				hsts := headers.Get("Strict-Transport-Security")
+				expected := "max-age=63072000"
+				if hsts != expected {
+					t.Errorf("Expected HSTS '%s', got '%s'", expected, hsts)
+				}
+			},
+		},
+		{
+			name: "Disabled security headers",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled: false,
+				},
+			},
+			setup: func(req *http.Request) *http.Request {
+				return req
+			},
+			check: func(t *testing.T, headers http.Header) {
+				// Since applier should be nil, this won't be called
+				// but we include it for completeness
+			},
+		},
+		{
+			name: "Remove server headers",
+			config: &Config{
+				SecurityHeaders: &SecurityHeadersConfig{
+					Enabled:                true,
+					DisableServerHeader:    true,
+					DisablePoweredByHeader: true,
+				},
+			},
+			setup: func(req *http.Request) *http.Request {
+				return req
+			},
+			check: func(t *testing.T, headers http.Header) {
+				// Headers should be explicitly deleted
+				// We can't easily test deletion, but we ensure they're not set
+				if server := headers.Get("Server"); server != "" {
+					t.Errorf("Expected Server header to be removed, got '%s'", server)
+				}
+				if powered := headers.Get("X-Powered-By"); powered != "" {
+					t.Errorf("Expected X-Powered-By header to be removed, got '%s'", powered)
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			applier := tt.config.GetSecurityHeadersApplier()
+
+			if !tt.config.SecurityHeaders.Enabled {
+				if applier != nil {
+					t.Error("Expected nil applier for disabled security headers")
+				}
+				return
+			}
+
+			if applier == nil {
+				t.Fatal("Expected non-nil applier for enabled security headers")
+			}
+
+			req := httptest.NewRequest("GET", "https://example.com/test", nil)
+			req = tt.setup(req)
+			rw := httptest.NewRecorder()
+
+			// Pre-set some headers that should be removed
+			rw.Header().Set("Server", "nginx/1.0")
+			rw.Header().Set("X-Powered-By", "Express")
+
+			applier(rw, req)
+			tt.check(t, rw.Header())
+		})
+	}
+}
+
+func TestToInternalSecurityConfigComprehensive(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   *SecurityHeadersConfig
+		expected map[string]interface{}
+	}{
+		{
+			name:     "Nil config",
+			config:   nil,
+			expected: nil,
+		},
+		{
+			name: "Disabled config",
+			config: &SecurityHeadersConfig{
+				Enabled: false,
+			},
+			expected: nil,
+		},
+		{
+			name: "Custom profile with all options",
+			config: &SecurityHeadersConfig{
+				Enabled:                           true,
+				Profile:                           "custom",
+				ContentSecurityPolicy:             "default-src 'none'",
+				FrameOptions:                      "ALLOW-FROM https://example.com",
+				ContentTypeOptions:                "nosniff",
+				XSSProtection:                     "0",
+				ReferrerPolicy:                    "no-referrer",
+				PermissionsPolicy:                 "camera=(), microphone=()",
+				CrossOriginEmbedderPolicy:         "require-corp",
+				CrossOriginOpenerPolicy:           "same-origin",
+				CrossOriginResourcePolicy:         "cross-origin",
+				StrictTransportSecurity:           true,
+				StrictTransportSecurityMaxAge:     15552000,
+				StrictTransportSecuritySubdomains: false,
+				StrictTransportSecurityPreload:    true,
+				CORSEnabled:                       true,
+				CORSAllowedOrigins:                []string{"https://api.example.com"},
+				CORSAllowedMethods:                []string{"PUT", "DELETE"},
+				CORSAllowedHeaders:                []string{"X-API-Key"},
+				CORSAllowCredentials:              false,
+				CORSMaxAge:                        3600,
+				CustomHeaders:                     map[string]string{"X-API-Version": "v1"},
+				DisableServerHeader:               true,
+				DisablePoweredByHeader:            false,
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":                   false,
+				"ContentSecurityPolicy":             "default-src 'none'",
+				"FrameOptions":                      "ALLOW-FROM https://example.com",
+				"ContentTypeOptions":                "nosniff",
+				"XSSProtection":                     "0",
+				"ReferrerPolicy":                    "no-referrer",
+				"PermissionsPolicy":                 "camera=(), microphone=()",
+				"CrossOriginEmbedderPolicy":         "require-corp",
+				"CrossOriginOpenerPolicy":           "same-origin",
+				"CrossOriginResourcePolicy":         "cross-origin",
+				"StrictTransportSecurityMaxAge":     15552000,
+				"StrictTransportSecuritySubdomains": false,
+				"StrictTransportSecurityPreload":    true,
+				"CORSEnabled":                       true,
+				"CORSAllowedOrigins":                []string{"https://api.example.com"},
+				"CORSAllowedMethods":                []string{"PUT", "DELETE"},
+				"CORSAllowedHeaders":                []string{"X-API-Key"},
+				"CORSAllowCredentials":              false,
+				"CORSMaxAge":                        3600,
+				"CustomHeaders":                     map[string]string{"X-API-Version": "v1"},
+				"DisableServerHeader":               true,
+				"DisablePoweredByHeader":            false,
+			},
+		},
+		{
+			name: "Development profile",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "development",
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":           true,
+				"ContentSecurityPolicy":     "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https: http:; connect-src 'self' ws: wss:;",
+				"FrameOptions":              "SAMEORIGIN",
+				"ContentTypeOptions":        "nosniff",
+				"XSSProtection":             "1; mode=block",
+				"ReferrerPolicy":            "strict-origin-when-cross-origin",
+				"CrossOriginOpenerPolicy":   "unsafe-none",
+				"CrossOriginResourcePolicy": "cross-origin",
+				"CORSEnabled":               false,
+				"CORSAllowCredentials":      false,
+				"DisableServerHeader":       false,
+				"DisablePoweredByHeader":    false,
+			},
+		},
+		{
+			name: "API profile",
+			config: &SecurityHeadersConfig{
+				Enabled: true,
+				Profile: "api",
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":           false,
+				"ContentSecurityPolicy":     "default-src 'none'; frame-ancestors 'none';",
+				"FrameOptions":              "DENY",
+				"ContentTypeOptions":        "nosniff",
+				"XSSProtection":             "1; mode=block",
+				"ReferrerPolicy":            "strict-origin-when-cross-origin",
+				"CrossOriginResourcePolicy": "cross-origin",
+				"CORSEnabled":               false,
+				"CORSAllowCredentials":      false,
+				"DisableServerHeader":       false,
+				"DisablePoweredByHeader":    false,
+			},
+		},
+		{
+			name: "Partial configuration",
+			config: &SecurityHeadersConfig{
+				Enabled:      true,
+				Profile:      "default",
+				FrameOptions: "SAMEORIGIN", // Override default
+				CORSEnabled:  true,         // Enable CORS
+			},
+			expected: map[string]interface{}{
+				"DevelopmentMode":           false,
+				"ContentSecurityPolicy":     "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';",
+				"FrameOptions":              "SAMEORIGIN", // Overridden
+				"ContentTypeOptions":        "nosniff",
+				"XSSProtection":             "1; mode=block",
+				"ReferrerPolicy":            "strict-origin-when-cross-origin",
+				"PermissionsPolicy":         "geolocation=(), microphone=(), camera=(), payment=(), usb=()",
+				"CrossOriginEmbedderPolicy": "require-corp",
+				"CrossOriginOpenerPolicy":   "same-origin",
+				"CrossOriginResourcePolicy": "same-origin",
+				"CORSEnabled":               true, // Explicitly set
+				"CORSAllowCredentials":      false,
+				"DisableServerHeader":       false,
+				"DisablePoweredByHeader":    false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.ToInternalSecurityConfig()
+
+			if tt.expected == nil {
+				if result != nil {
+					t.Errorf("Expected nil result, got %+v", result)
+				}
+				return
+			}
+
+			if result == nil {
+				t.Fatal("Expected non-nil result")
+			}
+
+			resultMap, ok := result.(map[string]interface{})
+			if !ok {
+				t.Errorf("Expected result to be map[string]interface{}, got %T", result)
+				return
+			}
+
+			for key, expectedValue := range tt.expected {
+				actualValue, exists := resultMap[key]
+				if !exists {
+					t.Errorf("Expected key '%s' not found in result", key)
+					continue
+				}
+
+				if !reflect.DeepEqual(actualValue, expectedValue) {
+					t.Errorf("For key '%s': expected %v (%T), got %v (%T)",
+						key, expectedValue, expectedValue, actualValue, actualValue)
+				}
+			}
+
+			// Check that no unexpected keys are present
+			for key := range resultMap {
+				if _, expected := tt.expected[key]; !expected {
+					t.Errorf("Unexpected key '%s' found in result with value %v", key, resultMap[key])
+				}
+			}
+		})
+	}
+}

error_recovery.go

@@ -963,7 +963,7 @@ func (gd *GracefulDegradation) Close() {
 			// Don't set to nil to avoid race conditions
 		}
 
-		gd.logger.Info("GracefulDegradation shut down successfully")
+		gd.logger.Debug("GracefulDegradation shut down successfully")
 	})
 }
 

http_client_factory.go

@@ -49,10 +49,10 @@ func DefaultHTTPClientConfig() HTTPClientConfig {
 		TLSHandshakeTimeout:   2 * time.Second,
 		ResponseHeaderTimeout: 3 * time.Second,
 		ExpectContinueTimeout: 1 * time.Second,
-		IdleConnTimeout:       5 * time.Second,
-		MaxIdleConns:          20, // SECURITY FIX: Reduced from 100 to limit resource usage
-		MaxIdleConnsPerHost:   2,  // SECURITY FIX: Reduced from 10 to prevent connection exhaustion
-		MaxConnsPerHost:       5,  // SECURITY FIX: Reduced from 10 to limit concurrent connections
+		IdleConnTimeout:       30 * time.Second, // OPTIMIZATION: Increased for better connection reuse
+		MaxIdleConns:          50,               // OPTIMIZATION: Increased from 20 for better connection pooling
+		MaxIdleConnsPerHost:   10,               // OPTIMIZATION: Increased from 2 for better connection reuse
+		MaxConnsPerHost:       20,               // OPTIMIZATION: Increased from 5 while maintaining security
 		WriteBufferSize:       4096,
 		ReadBufferSize:        4096,
 		ForceHTTP2:            true,
@@ -70,6 +70,18 @@ func TokenHTTPClientConfig() HTTPClientConfig {
 	return config
 }
 
+// OIDCProviderHTTPClientConfig returns configuration optimized for OIDC provider calls
+func OIDCProviderHTTPClientConfig() HTTPClientConfig {
+	config := DefaultHTTPClientConfig()
+	config.Timeout = 15 * time.Second         // Slightly longer for OIDC operations
+	config.MaxIdleConns = 100                 // Higher pool for frequent OIDC calls
+	config.MaxIdleConnsPerHost = 25           // More connections per OIDC provider
+	config.MaxConnsPerHost = 50               // Allow more concurrent requests to OIDC provider
+	config.IdleConnTimeout = 90 * time.Second // Keep connections alive longer for reuse
+	config.UseCookieJar = true                // Enable cookie jar for session management
+	return config
+}
+
 // HTTPClientFactory provides methods for creating configured HTTP clients
 type HTTPClientFactory struct{}
 

internal/cache/typed_cache.go

@@ -1,9 +1,12 @@
 package cache
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/pool"
 )
 
 // TypedCache provides a type-safe wrapper around Cache for specific types
@@ -42,13 +45,24 @@ func (tc *TypedCache[T]) Get(key string) (T, bool) {
 	}
 
 	// If that fails, try JSON marshaling/unmarshaling for complex types
-	data, err := json.Marshal(value)
-	if err != nil {
+	// Use pooled buffer for encoding
+	pm := pool.Get()
+	buf := pm.GetBuffer(256)
+	defer pm.PutBuffer(buf)
+
+	encoder := pm.GetJSONEncoder(buf)
+	defer pm.PutJSONEncoder(encoder)
+
+	if err := encoder.Encode(value); err != nil {
 		return zero, false
 	}
 
+	// Decode using pooled decoder
 	var result T
-	if err := json.Unmarshal(data, &result); err != nil {
+	decoder := pm.GetJSONDecoder(bytes.NewReader(buf.Bytes()))
+	defer pm.PutJSONDecoder(decoder)
+
+	if err := decoder.Decode(&result); err != nil {
 		return zero, false
 	}
 

internal/errors/errors_test.go

@@ -0,0 +1,529 @@
+package errors
+
+import (
+	"errors"
+	"net/http"
+	"reflect"
+	"testing"
+)
+
+func TestOIDCError_Error(t *testing.T) {
+	tests := []struct {
+		name     string
+		oidcErr  *OIDCError
+		expected string
+	}{
+		{
+			name: "Error with details",
+			oidcErr: &OIDCError{
+				Code:    ErrCodeTokenInvalid,
+				Message: "Token validation failed",
+				Details: "JWT signature invalid",
+			},
+			expected: "TOKEN_INVALID: Token validation failed (JWT signature invalid)",
+		},
+		{
+			name: "Error without details",
+			oidcErr: &OIDCError{
+				Code:    ErrCodeAuthenticationFailed,
+				Message: "Authentication failed",
+			},
+			expected: "AUTH_FAILED: Authentication failed",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.oidcErr.Error()
+			if result != tt.expected {
+				t.Errorf("Expected '%s', got '%s'", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestOIDCError_Unwrap(t *testing.T) {
+	internalErr := errors.New("internal error")
+	oidcErr := &OIDCError{
+		Code:     ErrCodeTokenInvalid,
+		Message:  "Token validation failed",
+		Internal: internalErr,
+	}
+
+	unwrapped := oidcErr.Unwrap()
+	if unwrapped != internalErr {
+		t.Errorf("Expected internal error, got %v", unwrapped)
+	}
+
+	// Test with nil internal error
+	oidcErrNoInternal := &OIDCError{
+		Code:    ErrCodeTokenInvalid,
+		Message: "Token validation failed",
+	}
+
+	unwrappedNil := oidcErrNoInternal.Unwrap()
+	if unwrappedNil != nil {
+		t.Errorf("Expected nil, got %v", unwrappedNil)
+	}
+}
+
+func TestOIDCError_IsRetryable(t *testing.T) {
+	tests := []struct {
+		name     string
+		code     ErrorCode
+		expected bool
+	}{
+		{"Network timeout", ErrCodeNetworkTimeout, true},
+		{"Service unavailable", ErrCodeServiceUnavailable, true},
+		{"Provider unreachable", ErrCodeProviderUnreachable, true},
+		{"Authentication failed", ErrCodeAuthenticationFailed, false},
+		{"Token invalid", ErrCodeTokenInvalid, false},
+		{"Rate limited", ErrCodeRateLimited, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			oidcErr := &OIDCError{Code: tt.code}
+			result := oidcErr.IsRetryable()
+			if result != tt.expected {
+				t.Errorf("Expected %v, got %v for code %s", tt.expected, result, tt.code)
+			}
+		})
+	}
+}
+
+func TestOIDCError_IsAuthenticationError(t *testing.T) {
+	tests := []struct {
+		name     string
+		code     ErrorCode
+		expected bool
+	}{
+		{"Authentication failed", ErrCodeAuthenticationFailed, true},
+		{"Token expired", ErrCodeTokenExpired, true},
+		{"Token invalid", ErrCodeTokenInvalid, true},
+		{"Session expired", ErrCodeSessionExpired, true},
+		{"CSRF mismatch", ErrCodeCSRFMismatch, true},
+		{"Nonce mismatch", ErrCodeNonceMismatch, true},
+		{"Config invalid", ErrCodeConfigInvalid, false},
+		{"Domain not allowed", ErrCodeDomainNotAllowed, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			oidcErr := &OIDCError{Code: tt.code}
+			result := oidcErr.IsAuthenticationError()
+			if result != tt.expected {
+				t.Errorf("Expected %v, got %v for code %s", tt.expected, result, tt.code)
+			}
+		})
+	}
+}
+
+func TestOIDCError_IsAuthorizationError(t *testing.T) {
+	tests := []struct {
+		name     string
+		code     ErrorCode
+		expected bool
+	}{
+		{"Domain not allowed", ErrCodeDomainNotAllowed, true},
+		{"User not allowed", ErrCodeUserNotAllowed, true},
+		{"Role not allowed", ErrCodeRoleNotAllowed, true},
+		{"Authentication failed", ErrCodeAuthenticationFailed, false},
+		{"Token expired", ErrCodeTokenExpired, false},
+		{"Config invalid", ErrCodeConfigInvalid, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			oidcErr := &OIDCError{Code: tt.code}
+			result := oidcErr.IsAuthorizationError()
+			if result != tt.expected {
+				t.Errorf("Expected %v, got %v for code %s", tt.expected, result, tt.code)
+			}
+		})
+	}
+}
+
+func TestOIDCError_ToJSON(t *testing.T) {
+	tests := []struct {
+		name     string
+		oidcErr  *OIDCError
+		expected map[string]any
+	}{
+		{
+			name: "Error with details",
+			oidcErr: &OIDCError{
+				Code:    ErrCodeTokenInvalid,
+				Message: "Token validation failed",
+				Details: "JWT signature invalid",
+			},
+			expected: map[string]any{
+				"error": map[string]any{
+					"code":    "TOKEN_INVALID",
+					"message": "Token validation failed",
+					"details": "JWT signature invalid",
+				},
+			},
+		},
+		{
+			name: "Error without details",
+			oidcErr: &OIDCError{
+				Code:    ErrCodeAuthenticationFailed,
+				Message: "Authentication failed",
+			},
+			expected: map[string]any{
+				"error": map[string]any{
+					"code":    "AUTH_FAILED",
+					"message": "Authentication failed",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.oidcErr.ToJSON()
+			if !reflect.DeepEqual(result, tt.expected) {
+				t.Errorf("Expected %+v, got %+v", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestNewAuthenticationError(t *testing.T) {
+	internalErr := errors.New("internal error")
+
+	tests := []struct {
+		name         string
+		code         ErrorCode
+		message      string
+		internal     error
+		expectedHTTP int
+	}{
+		{
+			name:         "Regular auth error",
+			code:         ErrCodeAuthenticationFailed,
+			message:      "Auth failed",
+			internal:     internalErr,
+			expectedHTTP: http.StatusUnauthorized,
+		},
+		{
+			name:         "Session expired error",
+			code:         ErrCodeSessionExpired,
+			message:      "Session expired",
+			internal:     internalErr,
+			expectedHTTP: http.StatusForbidden,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := NewAuthenticationError(tt.code, tt.message, tt.internal)
+
+			if err.Code != tt.code {
+				t.Errorf("Expected code %s, got %s", tt.code, err.Code)
+			}
+			if err.Message != tt.message {
+				t.Errorf("Expected message '%s', got '%s'", tt.message, err.Message)
+			}
+			if err.Internal != tt.internal {
+				t.Errorf("Expected internal error %v, got %v", tt.internal, err.Internal)
+			}
+			if err.HTTPStatus != tt.expectedHTTP {
+				t.Errorf("Expected HTTP status %d, got %d", tt.expectedHTTP, err.HTTPStatus)
+			}
+		})
+	}
+}
+
+func TestNewAuthorizationError(t *testing.T) {
+	err := NewAuthorizationError(ErrCodeDomainNotAllowed, "Domain not allowed", "example.com not in whitelist")
+
+	if err.Code != ErrCodeDomainNotAllowed {
+		t.Errorf("Expected code %s, got %s", ErrCodeDomainNotAllowed, err.Code)
+	}
+	if err.Message != "Domain not allowed" {
+		t.Errorf("Expected message 'Domain not allowed', got '%s'", err.Message)
+	}
+	if err.Details != "example.com not in whitelist" {
+		t.Errorf("Expected details 'example.com not in whitelist', got '%s'", err.Details)
+	}
+	if err.HTTPStatus != http.StatusForbidden {
+		t.Errorf("Expected HTTP status %d, got %d", http.StatusForbidden, err.HTTPStatus)
+	}
+}
+
+func TestNewConfigurationError(t *testing.T) {
+	internalErr := errors.New("config parse error")
+	err := NewConfigurationError(ErrCodeConfigInvalid, "Invalid config", internalErr)
+
+	if err.Code != ErrCodeConfigInvalid {
+		t.Errorf("Expected code %s, got %s", ErrCodeConfigInvalid, err.Code)
+	}
+	if err.HTTPStatus != http.StatusInternalServerError {
+		t.Errorf("Expected HTTP status %d, got %d", http.StatusInternalServerError, err.HTTPStatus)
+	}
+	if err.Internal != internalErr {
+		t.Errorf("Expected internal error %v, got %v", internalErr, err.Internal)
+	}
+}
+
+func TestNewNetworkError(t *testing.T) {
+	internalErr := errors.New("network error")
+
+	tests := []struct {
+		name         string
+		code         ErrorCode
+		expectedHTTP int
+	}{
+		{
+			name:         "Rate limited",
+			code:         ErrCodeRateLimited,
+			expectedHTTP: http.StatusTooManyRequests,
+		},
+		{
+			name:         "Service unavailable",
+			code:         ErrCodeServiceUnavailable,
+			expectedHTTP: http.StatusServiceUnavailable,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := NewNetworkError(tt.code, "Network error", internalErr)
+
+			if err.Code != tt.code {
+				t.Errorf("Expected code %s, got %s", tt.code, err.Code)
+			}
+			if err.HTTPStatus != tt.expectedHTTP {
+				t.Errorf("Expected HTTP status %d, got %d", tt.expectedHTTP, err.HTTPStatus)
+			}
+		})
+	}
+}
+
+func TestNewValidationError(t *testing.T) {
+	err := NewValidationError(ErrCodeValidationFailed, "Validation failed", "field 'email' is required")
+
+	if err.Code != ErrCodeValidationFailed {
+		t.Errorf("Expected code %s, got %s", ErrCodeValidationFailed, err.Code)
+	}
+	if err.HTTPStatus != http.StatusBadRequest {
+		t.Errorf("Expected HTTP status %d, got %d", http.StatusBadRequest, err.HTTPStatus)
+	}
+	if err.Details != "field 'email' is required" {
+		t.Errorf("Expected details 'field 'email' is required', got '%s'", err.Details)
+	}
+}
+
+func TestWrapAuthenticationError(t *testing.T) {
+	internalErr := errors.New("original error")
+	err := WrapAuthenticationError(internalErr, "Custom auth message")
+
+	if err.Code != ErrCodeAuthenticationFailed {
+		t.Errorf("Expected code %s, got %s", ErrCodeAuthenticationFailed, err.Code)
+	}
+	if err.Message != "Custom auth message" {
+		t.Errorf("Expected message 'Custom auth message', got '%s'", err.Message)
+	}
+	if err.Internal != internalErr {
+		t.Errorf("Expected internal error %v, got %v", internalErr, err.Internal)
+	}
+}
+
+func TestWrapTokenError(t *testing.T) {
+	internalErr := errors.New("token error")
+	err := WrapTokenError(internalErr, "ID token")
+
+	if err.Code != ErrCodeTokenInvalid {
+		t.Errorf("Expected code %s, got %s", ErrCodeTokenInvalid, err.Code)
+	}
+	if err.Message != "Token validation failed: ID token" {
+		t.Errorf("Expected message 'Token validation failed: ID token', got '%s'", err.Message)
+	}
+	if err.Internal != internalErr {
+		t.Errorf("Expected internal error %v, got %v", internalErr, err.Internal)
+	}
+}
+
+func TestWrapProviderError(t *testing.T) {
+	internalErr := errors.New("provider error")
+	err := WrapProviderError(internalErr, "https://provider.example.com")
+
+	if err.Code != ErrCodeProviderUnreachable {
+		t.Errorf("Expected code %s, got %s", ErrCodeProviderUnreachable, err.Code)
+	}
+	if err.Message != "Provider communication failed: https://provider.example.com" {
+		t.Errorf("Expected specific message, got '%s'", err.Message)
+	}
+	if err.Internal != internalErr {
+		t.Errorf("Expected internal error %v, got %v", internalErr, err.Internal)
+	}
+}
+
+func TestIsOIDCError(t *testing.T) {
+	// Test with OIDCError
+	oidcErr := &OIDCError{Code: ErrCodeTokenInvalid, Message: "test"}
+	result, ok := IsOIDCError(oidcErr)
+	if !ok {
+		t.Error("Expected IsOIDCError to return true for OIDCError")
+	}
+	if result != oidcErr {
+		t.Error("Expected to get the same OIDCError back")
+	}
+
+	// Test with regular error
+	regularErr := errors.New("regular error")
+	result, ok = IsOIDCError(regularErr)
+	if ok {
+		t.Error("Expected IsOIDCError to return false for regular error")
+	}
+	if result != nil {
+		t.Error("Expected nil result for regular error")
+	}
+}
+
+func TestGetHTTPStatus(t *testing.T) {
+	// Test with OIDCError
+	oidcErr := &OIDCError{
+		Code:       ErrCodeTokenInvalid,
+		HTTPStatus: http.StatusUnauthorized,
+	}
+	status := GetHTTPStatus(oidcErr)
+	if status != http.StatusUnauthorized {
+		t.Errorf("Expected %d, got %d", http.StatusUnauthorized, status)
+	}
+
+	// Test with regular error
+	regularErr := errors.New("regular error")
+	status = GetHTTPStatus(regularErr)
+	if status != http.StatusInternalServerError {
+		t.Errorf("Expected %d, got %d", http.StatusInternalServerError, status)
+	}
+}
+
+func TestFormatUserMessage(t *testing.T) {
+	tests := []struct {
+		name     string
+		err      error
+		expected string
+	}{
+		{
+			name:     "Domain not allowed",
+			err:      &OIDCError{Code: ErrCodeDomainNotAllowed},
+			expected: "Your email domain is not authorized for this application",
+		},
+		{
+			name:     "User not allowed",
+			err:      &OIDCError{Code: ErrCodeUserNotAllowed},
+			expected: "Your account is not authorized for this application",
+		},
+		{
+			name:     "Role not allowed",
+			err:      &OIDCError{Code: ErrCodeRoleNotAllowed},
+			expected: "You do not have the required permissions for this application",
+		},
+		{
+			name:     "Session expired",
+			err:      &OIDCError{Code: ErrCodeSessionExpired},
+			expected: "Your session has expired. Please log in again",
+		},
+		{
+			name:     "Token expired",
+			err:      &OIDCError{Code: ErrCodeTokenExpired},
+			expected: "Your authentication has expired. Please log in again",
+		},
+		{
+			name:     "Provider unreachable",
+			err:      &OIDCError{Code: ErrCodeProviderUnreachable},
+			expected: "Authentication service is temporarily unavailable. Please try again later",
+		},
+		{
+			name:     "Rate limited",
+			err:      &OIDCError{Code: ErrCodeRateLimited},
+			expected: "Too many requests. Please wait a moment and try again",
+		},
+		{
+			name:     "Unknown OIDC error",
+			err:      &OIDCError{Code: ErrCodeConfigInvalid},
+			expected: "Authentication failed. Please try again",
+		},
+		{
+			name:     "Regular error",
+			err:      errors.New("regular error"),
+			expected: "An unexpected error occurred. Please try again",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := FormatUserMessage(tt.err)
+			if result != tt.expected {
+				t.Errorf("Expected '%s', got '%s'", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestErrorCodes(t *testing.T) {
+	// Test that all error codes are defined correctly
+	codes := []ErrorCode{
+		ErrCodeAuthenticationFailed,
+		ErrCodeTokenExpired,
+		ErrCodeTokenInvalid,
+		ErrCodeSessionExpired,
+		ErrCodeCSRFMismatch,
+		ErrCodeNonceMismatch,
+		ErrCodeConfigInvalid,
+		ErrCodeProviderUnreachable,
+		ErrCodeMetadataFailed,
+		ErrCodeNetworkTimeout,
+		ErrCodeRateLimited,
+		ErrCodeServiceUnavailable,
+		ErrCodeValidationFailed,
+		ErrCodeDomainNotAllowed,
+		ErrCodeUserNotAllowed,
+		ErrCodeRoleNotAllowed,
+	}
+
+	for _, code := range codes {
+		if string(code) == "" {
+			t.Errorf("Error code %v is empty", code)
+		}
+	}
+}
+
+func TestErrorConstructorCompleteness(t *testing.T) {
+	// Test each constructor function to ensure they set all required fields
+	internalErr := errors.New("test error")
+
+	// Test NewAuthenticationError
+	authErr := NewAuthenticationError(ErrCodeAuthenticationFailed, "auth message", internalErr)
+	if authErr.Code == "" || authErr.Message == "" || authErr.HTTPStatus == 0 {
+		t.Error("NewAuthenticationError did not set all required fields")
+	}
+
+	// Test NewAuthorizationError
+	authzErr := NewAuthorizationError(ErrCodeDomainNotAllowed, "authz message", "details")
+	if authzErr.Code == "" || authzErr.Message == "" || authzErr.HTTPStatus == 0 {
+		t.Error("NewAuthorizationError did not set all required fields")
+	}
+
+	// Test NewConfigurationError
+	configErr := NewConfigurationError(ErrCodeConfigInvalid, "config message", internalErr)
+	if configErr.Code == "" || configErr.Message == "" || configErr.HTTPStatus == 0 {
+		t.Error("NewConfigurationError did not set all required fields")
+	}
+
+	// Test NewNetworkError
+	netErr := NewNetworkError(ErrCodeNetworkTimeout, "network message", internalErr)
+	if netErr.Code == "" || netErr.Message == "" || netErr.HTTPStatus == 0 {
+		t.Error("NewNetworkError did not set all required fields")
+	}
+
+	// Test NewValidationError
+	validErr := NewValidationError(ErrCodeValidationFailed, "validation message", "details")
+	if validErr.Code == "" || validErr.Message == "" || validErr.HTTPStatus == 0 {
+		t.Error("NewValidationError did not set all required fields")
+	}
+}

internal/handlers/auth_flow_test.go

@@ -0,0 +1,588 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// Mock implementations that embed SessionHandler
+type MockSessionHandlerWrapper struct {
+	*SessionHandler
+}
+
+func NewMockSessionHandlerWrapper() *MockSessionHandlerWrapper {
+	sessionManager := &MockSessionManager{}
+	logger := &MockLogger{}
+
+	sessionHandler := NewSessionHandler(
+		sessionManager,
+		logger,
+		"/logout",
+		"https://example.com/post-logout",
+		"https://provider.example.com/logout",
+		"test-client-id",
+	)
+
+	return &MockSessionHandlerWrapper{
+		SessionHandler: sessionHandler,
+	}
+}
+
+type MockSessionManager struct {
+	session Session
+	err     error
+}
+
+func (m *MockSessionManager) GetSession(req *http.Request) (Session, error) {
+	return m.session, m.err
+}
+
+func (m *MockSessionManager) CleanupOldCookies(rw http.ResponseWriter, req *http.Request) {
+	// Mock implementation
+}
+
+type MockSession struct {
+	authenticated bool
+	email         string
+	idToken       string
+	accessToken   string
+	refreshToken  string
+	saveError     error
+	clearError    error
+}
+
+func (m *MockSession) GetAuthenticated() bool                                { return m.authenticated }
+func (m *MockSession) SetAuthenticated(auth bool) error                      { m.authenticated = auth; return nil }
+func (m *MockSession) GetEmail() string                                      { return m.email }
+func (m *MockSession) SetEmail(email string)                                 { m.email = email }
+func (m *MockSession) GetIDToken() string                                    { return m.idToken }
+func (m *MockSession) GetAccessToken() string                                { return m.accessToken }
+func (m *MockSession) GetRefreshToken() string                               { return m.refreshToken }
+func (m *MockSession) SetRefreshToken(token string)                          { m.refreshToken = token }
+func (m *MockSession) Clear(req *http.Request, rw http.ResponseWriter) error { return m.clearError }
+func (m *MockSession) Save(req *http.Request, rw http.ResponseWriter) error  { return m.saveError }
+func (m *MockSession) ReturnToPoolSafely()                                   {}
+
+type MockTokenHandler struct {
+	verifyError   error
+	refreshError  error
+	tokenResponse *TokenResponse
+}
+
+func (m *MockTokenHandler) VerifyToken(token string) error {
+	return m.verifyError
+}
+
+func (m *MockTokenHandler) RefreshToken(refreshToken string) (*TokenResponse, error) {
+	return m.tokenResponse, m.refreshError
+}
+
+type MockLogger struct {
+	debugMessages []string
+	errorMessages []string
+}
+
+func (m *MockLogger) Debug(msg string) {
+	m.debugMessages = append(m.debugMessages, msg)
+}
+
+func (m *MockLogger) Debugf(format string, args ...interface{}) {
+	m.debugMessages = append(m.debugMessages, format)
+}
+
+func (m *MockLogger) Info(msg string) {}
+
+func (m *MockLogger) Infof(format string, args ...interface{}) {}
+
+func (m *MockLogger) Error(msg string) {
+	m.errorMessages = append(m.errorMessages, msg)
+}
+
+func (m *MockLogger) Errorf(format string, args ...interface{}) {
+	m.errorMessages = append(m.errorMessages, format)
+}
+
+func TestNewAuthFlowHandler(t *testing.T) {
+	sessionHandler := NewMockSessionHandlerWrapper()
+	tokenHandler := &MockTokenHandler{}
+	logger := &MockLogger{}
+	excludedURLs := map[string]struct{}{"/health": {}}
+	initComplete := make(chan struct{})
+	issuerURL := "https://issuer.example.com"
+
+	handler := NewAuthFlowHandler(sessionHandler.SessionHandler, tokenHandler, logger, excludedURLs, initComplete, issuerURL)
+
+	if handler == nil {
+		t.Fatal("NewAuthFlowHandler returned nil")
+	}
+
+	if handler.sessionHandler == nil {
+		t.Error("SessionHandler not set correctly")
+	}
+
+	if handler.tokenHandler != tokenHandler {
+		t.Error("TokenHandler not set correctly")
+	}
+
+	if handler.logger != logger {
+		t.Error("Logger not set correctly")
+	}
+
+	if handler.issuerURL != issuerURL {
+		t.Error("IssuerURL not set correctly")
+	}
+}
+
+func TestAuthFlowHandler_shouldExcludeURL(t *testing.T) {
+	excludedURLs := map[string]struct{}{
+		"/health":     {},
+		"/metrics":    {},
+		"/api/public": {},
+	}
+
+	handler := &AuthFlowHandler{excludedURLs: excludedURLs}
+
+	tests := []struct {
+		path     string
+		expected bool
+	}{
+		{"/health", true},
+		{"/health/check", true},
+		{"/metrics", true},
+		{"/metrics/prometheus", true},
+		{"/api/public", true},
+		{"/api/public/endpoint", true},
+		{"/api/private", false},
+		{"/login", false},
+		{"/dashboard", false},
+	}
+
+	for _, test := range tests {
+		result := handler.shouldExcludeURL(test.path)
+		if result != test.expected {
+			t.Errorf("For path '%s': expected %v, got %v", test.path, test.expected, result)
+		}
+	}
+}
+
+func TestAuthFlowHandler_isStreamingRequest(t *testing.T) {
+	handler := &AuthFlowHandler{}
+
+	tests := []struct {
+		name     string
+		accept   string
+		expected bool
+	}{
+		{
+			name:     "SSE request",
+			accept:   "text/event-stream",
+			expected: true,
+		},
+		{
+			name:     "Regular HTML request",
+			accept:   "text/html,application/xhtml+xml",
+			expected: false,
+		},
+		{
+			name:     "JSON request",
+			accept:   "application/json",
+			expected: false,
+		},
+		{
+			name:     "Empty accept header",
+			accept:   "",
+			expected: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "/", nil)
+			req.Header.Set("Accept", test.accept)
+
+			result := handler.isStreamingRequest(req)
+			if result != test.expected {
+				t.Errorf("Expected %v, got %v", test.expected, result)
+			}
+		})
+	}
+}
+
+func TestAuthFlowHandler_waitForInitialization(t *testing.T) {
+	tests := []struct {
+		name           string
+		setupHandler   func() (*AuthFlowHandler, context.CancelFunc)
+		expectedResult bool
+	}{
+		{
+			name: "Initialization complete successfully",
+			setupHandler: func() (*AuthFlowHandler, context.CancelFunc) {
+				initComplete := make(chan struct{})
+				close(initComplete) // Already complete
+				handler := &AuthFlowHandler{
+					initComplete: initComplete,
+					issuerURL:    "https://issuer.example.com",
+				}
+				return handler, nil
+			},
+			expectedResult: true,
+		},
+		{
+			name: "Initialization complete but no issuer URL",
+			setupHandler: func() (*AuthFlowHandler, context.CancelFunc) {
+				initComplete := make(chan struct{})
+				close(initComplete)
+				handler := &AuthFlowHandler{
+					initComplete: initComplete,
+					issuerURL:    "",
+					logger:       &MockLogger{},
+				}
+				return handler, nil
+			},
+			expectedResult: false,
+		},
+		{
+			name: "Request cancelled",
+			setupHandler: func() (*AuthFlowHandler, context.CancelFunc) {
+				initComplete := make(chan struct{})
+				handler := &AuthFlowHandler{
+					initComplete: initComplete,
+					logger:       &MockLogger{},
+				}
+				_, cancel := context.WithCancel(context.Background())
+				return handler, cancel
+			},
+			expectedResult: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler, cancelFunc := test.setupHandler()
+
+			req := httptest.NewRequest("GET", "/", nil)
+			if cancelFunc != nil {
+				ctx, cancel := context.WithCancel(context.Background())
+				req = req.WithContext(ctx)
+				cancel() // Cancel immediately
+			}
+
+			result := handler.waitForInitialization(req)
+			if result != test.expectedResult {
+				t.Errorf("Expected %v, got %v", test.expectedResult, result)
+			}
+		})
+	}
+}
+
+func TestAuthFlowHandler_ProcessRequest(t *testing.T) {
+	tests := []struct {
+		name           string
+		setupRequest   func() *http.Request
+		setupHandler   func() *AuthFlowHandler
+		expectedResult AuthFlowResult
+	}{
+		{
+			name: "Excluded URL bypasses authentication",
+			setupRequest: func() *http.Request {
+				return httptest.NewRequest("GET", "/health", nil)
+			},
+			setupHandler: func() *AuthFlowHandler {
+				return &AuthFlowHandler{
+					excludedURLs: map[string]struct{}{"/health": {}},
+					logger:       &MockLogger{},
+				}
+			},
+			expectedResult: AuthFlowResult{Authenticated: true},
+		},
+		{
+			name: "Streaming request bypasses authentication",
+			setupRequest: func() *http.Request {
+				req := httptest.NewRequest("GET", "/events", nil)
+				req.Header.Set("Accept", "text/event-stream")
+				return req
+			},
+			setupHandler: func() *AuthFlowHandler {
+				return &AuthFlowHandler{
+					excludedURLs: map[string]struct{}{},
+					logger:       &MockLogger{},
+				}
+			},
+			expectedResult: AuthFlowResult{Authenticated: true},
+		},
+		{
+			name: "Initialization timeout",
+			setupRequest: func() *http.Request {
+				return httptest.NewRequest("GET", "/dashboard", nil)
+			},
+			setupHandler: func() *AuthFlowHandler {
+				return &AuthFlowHandler{
+					excludedURLs: map[string]struct{}{},
+					initComplete: make(chan struct{}), // Never closes
+					logger:       &MockLogger{},
+				}
+			},
+			expectedResult: AuthFlowResult{
+				Error:      ErrInitializationTimeout,
+				StatusCode: http.StatusServiceUnavailable,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := test.setupRequest()
+			handler := test.setupHandler()
+			rw := httptest.NewRecorder()
+
+			// For timeout test, use context with timeout
+			if test.name == "Initialization timeout" {
+				ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+				defer cancel()
+				req = req.WithContext(ctx)
+			}
+
+			result := handler.ProcessRequest(rw, req)
+
+			if result.Authenticated != test.expectedResult.Authenticated {
+				t.Errorf("Expected Authenticated %v, got %v", test.expectedResult.Authenticated, result.Authenticated)
+			}
+
+			if result.StatusCode != test.expectedResult.StatusCode {
+				t.Errorf("Expected StatusCode %d, got %d", test.expectedResult.StatusCode, result.StatusCode)
+			}
+
+			if test.expectedResult.Error != nil && result.Error == nil {
+				t.Error("Expected error but got nil")
+			}
+		})
+	}
+}
+
+func TestAuthFlowHandler_validateAndRefreshTokens(t *testing.T) {
+	tests := []struct {
+		name           string
+		session        *MockSession
+		tokenHandler   *MockTokenHandler
+		expectedResult AuthFlowResult
+	}{
+		{
+			name: "Valid access token",
+			session: &MockSession{
+				authenticated: true,
+				accessToken:   "valid-access-token",
+			},
+			tokenHandler: &MockTokenHandler{
+				verifyError: nil,
+			},
+			expectedResult: AuthFlowResult{Authenticated: true},
+		},
+		{
+			name: "Invalid access token, successful refresh",
+			session: &MockSession{
+				authenticated: true,
+				accessToken:   "invalid-access-token",
+				refreshToken:  "valid-refresh-token",
+			},
+			tokenHandler: &MockTokenHandler{
+				verifyError:  errors.New("token expired"),
+				refreshError: nil,
+				tokenResponse: &TokenResponse{
+					IDToken:     "new-id-token",
+					AccessToken: "new-access-token",
+				},
+			},
+			expectedResult: AuthFlowResult{Authenticated: true},
+		},
+		{
+			name: "Invalid access token, no refresh token",
+			session: &MockSession{
+				authenticated: true,
+				accessToken:   "invalid-access-token",
+				refreshToken:  "",
+			},
+			tokenHandler: &MockTokenHandler{
+				verifyError: errors.New("token expired"),
+			},
+			expectedResult: AuthFlowResult{RequiresAuth: true},
+		},
+		{
+			name: "Valid ID token only",
+			session: &MockSession{
+				authenticated: true,
+				idToken:       "valid-id-token",
+			},
+			tokenHandler: &MockTokenHandler{
+				verifyError: nil,
+			},
+			expectedResult: AuthFlowResult{Authenticated: true},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler := &AuthFlowHandler{
+				tokenHandler: test.tokenHandler,
+				logger:       &MockLogger{},
+			}
+
+			req := httptest.NewRequest("GET", "/", nil)
+			rw := httptest.NewRecorder()
+
+			result := handler.validateAndRefreshTokens(test.session, req, rw)
+
+			if result.Authenticated != test.expectedResult.Authenticated {
+				t.Errorf("Expected Authenticated %v, got %v", test.expectedResult.Authenticated, result.Authenticated)
+			}
+
+			if result.RequiresAuth != test.expectedResult.RequiresAuth {
+				t.Errorf("Expected RequiresAuth %v, got %v", test.expectedResult.RequiresAuth, result.RequiresAuth)
+			}
+		})
+	}
+}
+
+func TestAuthFlowHandler_attemptTokenRefresh(t *testing.T) {
+	tests := []struct {
+		name           string
+		session        *MockSession
+		tokenHandler   *MockTokenHandler
+		isAjax         bool
+		expectedResult AuthFlowResult
+	}{
+		{
+			name: "No refresh token",
+			session: &MockSession{
+				refreshToken: "",
+			},
+			tokenHandler:   &MockTokenHandler{},
+			expectedResult: AuthFlowResult{RequiresAuth: true},
+		},
+		{
+			name: "AJAX request with expired session",
+			session: &MockSession{
+				refreshToken: "refresh-token",
+			},
+			tokenHandler: &MockTokenHandler{},
+			isAjax:       true,
+			expectedResult: AuthFlowResult{
+				Error:      ErrSessionExpiredAjax,
+				StatusCode: http.StatusUnauthorized,
+			},
+		},
+		{
+			name: "Successful token refresh",
+			session: &MockSession{
+				refreshToken: "valid-refresh-token",
+			},
+			tokenHandler: &MockTokenHandler{
+				refreshError: nil,
+				tokenResponse: &TokenResponse{
+					IDToken:     "new-id-token",
+					AccessToken: "new-access-token",
+				},
+			},
+			expectedResult: AuthFlowResult{Authenticated: true},
+		},
+		{
+			name: "Failed token refresh",
+			session: &MockSession{
+				refreshToken: "invalid-refresh-token",
+			},
+			tokenHandler: &MockTokenHandler{
+				refreshError: errors.New("refresh failed"),
+			},
+			expectedResult: AuthFlowResult{RequiresAuth: true},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sessionHandlerWrapper := NewMockSessionHandlerWrapper()
+			handler := &AuthFlowHandler{
+				sessionHandler: sessionHandlerWrapper.SessionHandler,
+				tokenHandler:   test.tokenHandler,
+				logger:         &MockLogger{},
+			}
+
+			req := httptest.NewRequest("GET", "/", nil)
+			if test.isAjax {
+				req.Header.Set("X-Requested-With", "XMLHttpRequest")
+			}
+			rw := httptest.NewRecorder()
+
+			result := handler.attemptTokenRefresh(test.session, req, rw)
+
+			if result.Authenticated != test.expectedResult.Authenticated {
+				t.Errorf("Expected Authenticated %v, got %v", test.expectedResult.Authenticated, result.Authenticated)
+			}
+
+			if result.RequiresAuth != test.expectedResult.RequiresAuth {
+				t.Errorf("Expected RequiresAuth %v, got %v", test.expectedResult.RequiresAuth, result.RequiresAuth)
+			}
+
+			if result.StatusCode != test.expectedResult.StatusCode {
+				t.Errorf("Expected StatusCode %d, got %d", test.expectedResult.StatusCode, result.StatusCode)
+			}
+		})
+	}
+}
+
+func TestAuthFlowError_Error(t *testing.T) {
+	err := &AuthFlowError{
+		Code:    "TEST_ERROR",
+		Message: "This is a test error",
+	}
+
+	expected := "This is a test error"
+	result := err.Error()
+
+	if result != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, result)
+	}
+}
+
+func TestAuthFlowResult(t *testing.T) {
+	// Test AuthFlowResult struct
+	result := AuthFlowResult{
+		Authenticated:   true,
+		RequiresAuth:    false,
+		RequiresRefresh: false,
+		Error:           nil,
+		RedirectURL:     "https://example.com",
+		StatusCode:      200,
+	}
+
+	if !result.Authenticated {
+		t.Error("Expected Authenticated to be true")
+	}
+
+	if result.RequiresAuth {
+		t.Error("Expected RequiresAuth to be false")
+	}
+
+	if result.StatusCode != 200 {
+		t.Errorf("Expected StatusCode 200, got %d", result.StatusCode)
+	}
+}
+
+func TestTokenResponse(t *testing.T) {
+	response := &TokenResponse{
+		IDToken:      "id-token-value",
+		AccessToken:  "access-token-value",
+		RefreshToken: "refresh-token-value",
+		ExpiresIn:    3600,
+	}
+
+	if response.IDToken != "id-token-value" {
+		t.Errorf("Expected IDToken 'id-token-value', got '%s'", response.IDToken)
+	}
+
+	if response.ExpiresIn != 3600 {
+		t.Errorf("Expected ExpiresIn 3600, got %d", response.ExpiresIn)
+	}
+}

internal/handlers/session_handler_test.go

@@ -0,0 +1,587 @@
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestNewSessionHandler(t *testing.T) {
+	sessionManager := &MockSessionManager{}
+	logger := &MockLogger{}
+	logoutURLPath := "/logout"
+	postLogoutRedirectURI := "https://example.com/post-logout"
+	endSessionURL := "https://provider.example.com/logout"
+	clientID := "test-client-id"
+
+	handler := NewSessionHandler(
+		sessionManager,
+		logger,
+		logoutURLPath,
+		postLogoutRedirectURI,
+		endSessionURL,
+		clientID,
+	)
+
+	if handler == nil {
+		t.Fatal("NewSessionHandler returned nil")
+	}
+
+	if handler.sessionManager != sessionManager {
+		t.Error("SessionManager not set correctly")
+	}
+
+	if handler.logger != logger {
+		t.Error("Logger not set correctly")
+	}
+
+	if handler.logoutURLPath != logoutURLPath {
+		t.Error("LogoutURLPath not set correctly")
+	}
+
+	if handler.postLogoutRedirectURI != postLogoutRedirectURI {
+		t.Error("PostLogoutRedirectURI not set correctly")
+	}
+
+	if handler.endSessionURL != endSessionURL {
+		t.Error("EndSessionURL not set correctly")
+	}
+
+	if handler.clientID != clientID {
+		t.Error("ClientID not set correctly")
+	}
+}
+
+func TestSessionHandler_HandleLogout(t *testing.T) {
+	tests := []struct {
+		name         string
+		setupSession func() *MockSession
+		setupManager func() *MockSessionManager
+		expectedCode int
+		expectedURL  string
+	}{
+		{
+			name: "Successful logout with ID token",
+			setupSession: func() *MockSession {
+				return &MockSession{
+					authenticated: true,
+					idToken:       "test-id-token",
+				}
+			},
+			setupManager: func() *MockSessionManager {
+				return &MockSessionManager{
+					session: &MockSession{
+						authenticated: true,
+						idToken:       "test-id-token",
+					},
+				}
+			},
+			expectedCode: http.StatusFound,
+			expectedURL:  "https://provider.example.com/logout?id_token_hint=test-id-token&post_logout_redirect_uri=https://example.com/post-logout&client_id=test-client-id",
+		},
+		{
+			name: "Logout without ID token",
+			setupSession: func() *MockSession {
+				return &MockSession{
+					authenticated: true,
+					idToken:       "",
+				}
+			},
+			setupManager: func() *MockSessionManager {
+				return &MockSessionManager{
+					session: &MockSession{
+						authenticated: true,
+						idToken:       "",
+					},
+				}
+			},
+			expectedCode: http.StatusFound,
+			expectedURL:  "https://provider.example.com/logout?post_logout_redirect_uri=https://example.com/post-logout&client_id=test-client-id",
+		},
+		{
+			name:         "Session retrieval error",
+			setupSession: func() *MockSession { return nil },
+			setupManager: func() *MockSessionManager {
+				return &MockSessionManager{
+					err: fmt.Errorf("session error"),
+				}
+			},
+			expectedCode: http.StatusFound,
+			expectedURL:  "https://provider.example.com/logout?post_logout_redirect_uri=https://example.com/post-logout&client_id=test-client-id",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler := &SessionHandler{
+				sessionManager:        test.setupManager(),
+				logger:                &MockLogger{},
+				logoutURLPath:         "/logout",
+				postLogoutRedirectURI: "https://example.com/post-logout",
+				endSessionURL:         "https://provider.example.com/logout",
+				clientID:              "test-client-id",
+			}
+
+			req := httptest.NewRequest("POST", "/logout", nil)
+			rw := httptest.NewRecorder()
+
+			handler.HandleLogout(rw, req)
+
+			if rw.Code != test.expectedCode {
+				t.Errorf("Expected status code %d, got %d", test.expectedCode, rw.Code)
+			}
+
+			location := rw.Header().Get("Location")
+			if location != test.expectedURL {
+				t.Errorf("Expected location '%s', got '%s'", test.expectedURL, location)
+			}
+		})
+	}
+}
+
+func TestSessionHandler_buildLogoutURL(t *testing.T) {
+	tests := []struct {
+		name                  string
+		endSessionURL         string
+		postLogoutRedirectURI string
+		clientID              string
+		idToken               string
+		expected              string
+	}{
+		{
+			name:                  "Complete logout URL with all parameters",
+			endSessionURL:         "https://provider.example.com/logout",
+			postLogoutRedirectURI: "https://example.com/post-logout",
+			clientID:              "test-client-id",
+			idToken:               "test-id-token",
+			expected:              "https://provider.example.com/logout?id_token_hint=test-id-token&post_logout_redirect_uri=https://example.com/post-logout&client_id=test-client-id",
+		},
+		{
+			name:                  "Logout URL without ID token",
+			endSessionURL:         "https://provider.example.com/logout",
+			postLogoutRedirectURI: "https://example.com/post-logout",
+			clientID:              "test-client-id",
+			idToken:               "",
+			expected:              "https://provider.example.com/logout?post_logout_redirect_uri=https://example.com/post-logout&client_id=test-client-id",
+		},
+		{
+			name:                  "No end session URL",
+			endSessionURL:         "",
+			postLogoutRedirectURI: "https://example.com/post-logout",
+			clientID:              "test-client-id",
+			idToken:               "test-id-token",
+			expected:              "https://example.com/post-logout",
+		},
+		{
+			name:                  "End session URL with existing query parameters",
+			endSessionURL:         "https://provider.example.com/logout?foo=bar",
+			postLogoutRedirectURI: "https://example.com/post-logout",
+			clientID:              "test-client-id",
+			idToken:               "",
+			expected:              "https://provider.example.com/logout?foo=bar&post_logout_redirect_uri=https://example.com/post-logout&client_id=test-client-id",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler := &SessionHandler{
+				endSessionURL:         test.endSessionURL,
+				postLogoutRedirectURI: test.postLogoutRedirectURI,
+				clientID:              test.clientID,
+			}
+
+			result := handler.buildLogoutURL(test.idToken)
+			if result != test.expected {
+				t.Errorf("Expected '%s', got '%s'", test.expected, result)
+			}
+		})
+	}
+}
+
+func TestSessionHandler_ValidateSession(t *testing.T) {
+	handler := &SessionHandler{}
+
+	tests := []struct {
+		name            string
+		session         Session
+		expectedValid   bool
+		expectedAuth    bool
+		expectedMessage string
+	}{
+		{
+			name:            "Nil session",
+			session:         nil,
+			expectedValid:   false,
+			expectedAuth:    true,
+			expectedMessage: "session is nil",
+		},
+		{
+			name: "Not authenticated session",
+			session: &MockSession{
+				authenticated: false,
+			},
+			expectedValid:   false,
+			expectedAuth:    true,
+			expectedMessage: "session not authenticated",
+		},
+		{
+			name: "Authenticated session without email",
+			session: &MockSession{
+				authenticated: true,
+				email:         "",
+			},
+			expectedValid:   false,
+			expectedAuth:    true,
+			expectedMessage: "no email in session",
+		},
+		{
+			name: "Valid authenticated session with email",
+			session: &MockSession{
+				authenticated: true,
+				email:         "[email protected]",
+			},
+			expectedValid:   true,
+			expectedAuth:    false,
+			expectedMessage: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := handler.ValidateSession(test.session)
+
+			if result.Valid != test.expectedValid {
+				t.Errorf("Expected Valid %v, got %v", test.expectedValid, result.Valid)
+			}
+
+			if result.NeedsAuth != test.expectedAuth {
+				t.Errorf("Expected NeedsAuth %v, got %v", test.expectedAuth, result.NeedsAuth)
+			}
+
+			if result.ErrorMessage != test.expectedMessage {
+				t.Errorf("Expected ErrorMessage '%s', got '%s'", test.expectedMessage, result.ErrorMessage)
+			}
+		})
+	}
+}
+
+func TestSessionHandler_CleanupExpiredSession(t *testing.T) {
+	tests := []struct {
+		name        string
+		session     *MockSession
+		expectError bool
+	}{
+		{
+			name: "Successful cleanup",
+			session: &MockSession{
+				authenticated: true,
+				email:         "[email protected]",
+				refreshToken:  "refresh-token",
+			},
+			expectError: false,
+		},
+		{
+			name: "Save error during cleanup",
+			session: &MockSession{
+				authenticated: true,
+				email:         "[email protected]",
+				refreshToken:  "refresh-token",
+				saveError:     fmt.Errorf("save failed"),
+			},
+			expectError: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler := &SessionHandler{
+				logger: &MockLogger{},
+			}
+
+			req := httptest.NewRequest("GET", "/", nil)
+			rw := httptest.NewRecorder()
+
+			err := handler.CleanupExpiredSession(rw, req, test.session)
+
+			if test.expectError && err == nil {
+				t.Error("Expected error but got nil")
+			}
+
+			if !test.expectError && err != nil {
+				t.Errorf("Expected no error but got: %v", err)
+			}
+
+			if test.session != nil && !test.expectError {
+				if test.session.authenticated {
+					t.Error("Expected session authenticated to be false after cleanup")
+				}
+
+				if test.session.email != "" {
+					t.Error("Expected session email to be empty after cleanup")
+				}
+
+				if test.session.refreshToken != "" {
+					t.Error("Expected session refresh token to be empty after cleanup")
+				}
+			}
+		})
+	}
+
+	// Test nil session separately
+	t.Run("Nil session", func(t *testing.T) {
+		handler := &SessionHandler{
+			logger: &MockLogger{},
+		}
+
+		req := httptest.NewRequest("GET", "/", nil)
+		rw := httptest.NewRecorder()
+
+		var nilSession Session = nil
+		err := handler.CleanupExpiredSession(rw, req, nilSession)
+
+		if err != nil {
+			t.Errorf("Expected no error for nil session, got: %v", err)
+		}
+	})
+}
+
+func TestSessionHandler_IsAjaxRequest(t *testing.T) {
+	handler := &SessionHandler{}
+
+	tests := []struct {
+		name     string
+		headers  map[string]string
+		expected bool
+	}{
+		{
+			name: "XMLHttpRequest header",
+			headers: map[string]string{
+				"X-Requested-With": "XMLHttpRequest",
+			},
+			expected: true,
+		},
+		{
+			name: "JSON Accept header without HTML",
+			headers: map[string]string{
+				"Accept": "application/json",
+			},
+			expected: true,
+		},
+		{
+			name: "JSON Accept header with HTML",
+			headers: map[string]string{
+				"Accept": "application/json, text/html",
+			},
+			expected: false,
+		},
+		{
+			name: "Fetch API CORS mode",
+			headers: map[string]string{
+				"Sec-Fetch-Mode": "cors",
+			},
+			expected: true,
+		},
+		{
+			name: "Regular browser request",
+			headers: map[string]string{
+				"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+			},
+			expected: false,
+		},
+		{
+			name:     "No special headers",
+			headers:  map[string]string{},
+			expected: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "/", nil)
+			for key, value := range test.headers {
+				req.Header.Set(key, value)
+			}
+
+			result := handler.IsAjaxRequest(req)
+			if result != test.expected {
+				t.Errorf("Expected %v, got %v", test.expected, result)
+			}
+		})
+	}
+}
+
+func TestSessionHandler_SendErrorResponse(t *testing.T) {
+	tests := []struct {
+		name                 string
+		isAjax               bool
+		message              string
+		statusCode           int
+		expectedContentType  string
+		expectedBodyContains string
+	}{
+		{
+			name:                 "AJAX error response",
+			isAjax:               true,
+			message:              "Authentication failed",
+			statusCode:           http.StatusUnauthorized,
+			expectedContentType:  "application/json",
+			expectedBodyContains: `{"error": "Authentication failed"}`,
+		},
+		{
+			name:                 "Browser error response",
+			isAjax:               false,
+			message:              "Session expired",
+			statusCode:           http.StatusForbidden,
+			expectedContentType:  "text/html",
+			expectedBodyContains: "<h1>Error 403</h1>",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler := &SessionHandler{}
+
+			req := httptest.NewRequest("GET", "/", nil)
+			if test.isAjax {
+				req.Header.Set("X-Requested-With", "XMLHttpRequest")
+			}
+
+			rw := httptest.NewRecorder()
+
+			handler.SendErrorResponse(rw, req, test.message, test.statusCode)
+
+			if rw.Code != test.statusCode {
+				t.Errorf("Expected status code %d, got %d", test.statusCode, rw.Code)
+			}
+
+			contentType := rw.Header().Get("Content-Type")
+			if contentType != test.expectedContentType {
+				t.Errorf("Expected Content-Type '%s', got '%s'", test.expectedContentType, contentType)
+			}
+
+			body := rw.Body.String()
+			if !strings.Contains(body, test.expectedBodyContains) {
+				t.Errorf("Expected body to contain '%s', got '%s'", test.expectedBodyContains, body)
+			}
+		})
+	}
+}
+
+func TestSessionHandler_SetSecurityHeaders(t *testing.T) {
+	tests := []struct {
+		name           string
+		method         string
+		origin         string
+		expectedCORS   bool
+		expectedStatus int
+	}{
+		{
+			name:           "Regular request without CORS",
+			method:         "GET",
+			origin:         "",
+			expectedCORS:   false,
+			expectedStatus: 0, // No status written
+		},
+		{
+			name:           "CORS request with origin",
+			method:         "GET",
+			origin:         "https://example.com",
+			expectedCORS:   true,
+			expectedStatus: 0,
+		},
+		{
+			name:           "OPTIONS preflight request",
+			method:         "OPTIONS",
+			origin:         "https://example.com",
+			expectedCORS:   true,
+			expectedStatus: http.StatusOK,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			handler := &SessionHandler{}
+
+			req := httptest.NewRequest(test.method, "/", nil)
+			if test.origin != "" {
+				req.Header.Set("Origin", test.origin)
+			}
+
+			rw := httptest.NewRecorder()
+
+			handler.SetSecurityHeaders(rw, req)
+
+			// Check standard security headers
+			expectedSecurityHeaders := map[string]string{
+				"X-Frame-Options":        "DENY",
+				"X-Content-Type-Options": "nosniff",
+				"X-XSS-Protection":       "1; mode=block",
+				"Referrer-Policy":        "strict-origin-when-cross-origin",
+			}
+
+			for header, expectedValue := range expectedSecurityHeaders {
+				actualValue := rw.Header().Get(header)
+				if actualValue != expectedValue {
+					t.Errorf("Expected %s header '%s', got '%s'", header, expectedValue, actualValue)
+				}
+			}
+
+			// Check CORS headers
+			if test.expectedCORS {
+				corsOrigin := rw.Header().Get("Access-Control-Allow-Origin")
+				if corsOrigin != test.origin {
+					t.Errorf("Expected CORS origin '%s', got '%s'", test.origin, corsOrigin)
+				}
+
+				corsCredentials := rw.Header().Get("Access-Control-Allow-Credentials")
+				if corsCredentials != "true" {
+					t.Errorf("Expected CORS credentials 'true', got '%s'", corsCredentials)
+				}
+
+				corsMethods := rw.Header().Get("Access-Control-Allow-Methods")
+				if corsMethods != "GET, POST, OPTIONS" {
+					t.Errorf("Expected CORS methods 'GET, POST, OPTIONS', got '%s'", corsMethods)
+				}
+
+				corsHeaders := rw.Header().Get("Access-Control-Allow-Headers")
+				if corsHeaders != "Authorization, Content-Type" {
+					t.Errorf("Expected CORS headers 'Authorization, Content-Type', got '%s'", corsHeaders)
+				}
+			} else {
+				corsOrigin := rw.Header().Get("Access-Control-Allow-Origin")
+				if corsOrigin != "" {
+					t.Errorf("Expected no CORS origin header, got '%s'", corsOrigin)
+				}
+			}
+
+			// Check status code for OPTIONS requests
+			if test.expectedStatus > 0 {
+				if rw.Code != test.expectedStatus {
+					t.Errorf("Expected status code %d, got %d", test.expectedStatus, rw.Code)
+				}
+			}
+		})
+	}
+}
+
+func TestSessionValidationResult(t *testing.T) {
+	result := SessionValidationResult{
+		Valid:        true,
+		NeedsAuth:    false,
+		ErrorMessage: "test message",
+	}
+
+	if !result.Valid {
+		t.Error("Expected Valid to be true")
+	}
+
+	if result.NeedsAuth {
+		t.Error("Expected NeedsAuth to be false")
+	}
+
+	if result.ErrorMessage != "test message" {
+		t.Errorf("Expected ErrorMessage 'test message', got '%s'", result.ErrorMessage)
+	}
+}

internal/middleware/request_handler.go

@@ -0,0 +1,122 @@
+package middleware
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// RequestContext holds request processing context
+type RequestContext struct {
+	Writer      http.ResponseWriter
+	Request     *http.Request
+	RedirectURL string
+	Scheme      string
+	Host        string
+}
+
+// RequestProcessor handles common request processing operations
+type RequestProcessor struct {
+	logger Logger
+}
+
+// Logger interface for logging operations
+type Logger interface {
+	Debug(msg string)
+	Debugf(format string, args ...interface{})
+	Error(msg string)
+	Errorf(format string, args ...interface{})
+	Info(msg string)
+	Infof(format string, args ...interface{})
+}
+
+// NewRequestProcessor creates a new request processor
+func NewRequestProcessor(logger Logger) *RequestProcessor {
+	return &RequestProcessor{
+		logger: logger,
+	}
+}
+
+// BuildRequestContext creates a request context with scheme and host detection
+func (rp *RequestProcessor) BuildRequestContext(rw http.ResponseWriter, req *http.Request, redirectPath string) *RequestContext {
+	scheme := rp.determineScheme(req)
+	host := rp.determineHost(req)
+	redirectURL := buildFullURL(scheme, host, redirectPath)
+
+	return &RequestContext{
+		Writer:      rw,
+		Request:     req,
+		RedirectURL: redirectURL,
+		Scheme:      scheme,
+		Host:        host,
+	}
+}
+
+// IsHealthCheckRequest checks if request is a health check
+func (rp *RequestProcessor) IsHealthCheckRequest(req *http.Request) bool {
+	return strings.HasPrefix(req.URL.Path, "/health")
+}
+
+// IsEventStreamRequest checks if request expects event stream
+func (rp *RequestProcessor) IsEventStreamRequest(req *http.Request) bool {
+	acceptHeader := req.Header.Get("Accept")
+	return strings.Contains(acceptHeader, "text/event-stream")
+}
+
+// IsAjaxRequest determines if this is an AJAX request
+func (rp *RequestProcessor) IsAjaxRequest(req *http.Request) bool {
+	xhr := req.Header.Get("X-Requested-With")
+	contentType := req.Header.Get("Content-Type")
+	accept := req.Header.Get("Accept")
+
+	return xhr == "XMLHttpRequest" ||
+		strings.Contains(contentType, "application/json") ||
+		strings.Contains(accept, "application/json")
+}
+
+// WaitForInitialization waits for OIDC provider initialization with timeout
+func (rp *RequestProcessor) WaitForInitialization(req *http.Request, initComplete <-chan struct{}) error {
+	select {
+	case <-initComplete:
+		return nil
+	case <-req.Context().Done():
+		rp.logger.Debug("Request cancelled while waiting for OIDC initialization")
+		return fmt.Errorf("request cancelled")
+	case <-time.After(30 * time.Second):
+		rp.logger.Error("Timeout waiting for OIDC initialization")
+		return fmt.Errorf("timeout waiting for OIDC provider initialization")
+	}
+}
+
+// determineScheme determines the URL scheme for building redirect URLs
+func (rp *RequestProcessor) determineScheme(req *http.Request) string {
+	if scheme := req.Header.Get("X-Forwarded-Proto"); scheme != "" {
+		return scheme
+	}
+	if req.TLS != nil {
+		return "https"
+	}
+	return "http"
+}
+
+// determineHost determines the host for building redirect URLs
+func (rp *RequestProcessor) determineHost(req *http.Request) string {
+	if host := req.Header.Get("X-Forwarded-Host"); host != "" {
+		return host
+	}
+	return req.Host
+}
+
+// buildFullURL constructs a complete URL from scheme, host, and path components
+func buildFullURL(scheme, host, path string) string {
+	if strings.HasPrefix(path, "http://") || strings.HasPrefix(path, "https://") {
+		return path
+	}
+
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+
+	return fmt.Sprintf("%s://%s%s", scheme, host, path)
+}

internal/middleware/request_handler_test.go

@@ -0,0 +1,655 @@
+package middleware
+
+import (
+	"context"
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+// MockLogger implements the Logger interface for testing
+type MockLogger struct {
+	DebugCalls  []string
+	DebugfCalls []string
+	ErrorCalls  []string
+	ErrorfCalls []string
+	InfoCalls   []string
+	InfofCalls  []string
+}
+
+func (m *MockLogger) Debug(msg string) {
+	m.DebugCalls = append(m.DebugCalls, msg)
+}
+
+func (m *MockLogger) Debugf(format string, args ...interface{}) {
+	m.DebugfCalls = append(m.DebugfCalls, format)
+}
+
+func (m *MockLogger) Error(msg string) {
+	m.ErrorCalls = append(m.ErrorCalls, msg)
+}
+
+func (m *MockLogger) Errorf(format string, args ...interface{}) {
+	m.ErrorfCalls = append(m.ErrorfCalls, format)
+}
+
+func (m *MockLogger) Info(msg string) {
+	m.InfoCalls = append(m.InfoCalls, msg)
+}
+
+func (m *MockLogger) Infof(format string, args ...interface{}) {
+	m.InfofCalls = append(m.InfofCalls, format)
+}
+
+// TestNewRequestProcessor tests the constructor
+func TestNewRequestProcessor(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	if processor == nil {
+		t.Error("Expected NewRequestProcessor to return non-nil processor")
+		return
+	}
+
+	if processor.logger != logger {
+		t.Error("Expected processor to use provided logger")
+	}
+}
+
+// TestBuildRequestContext tests request context building
+func TestBuildRequestContext(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	tests := []struct {
+		name         string
+		setupRequest func() (*http.Request, http.ResponseWriter)
+		redirectPath string
+		expectedURL  string
+		expectedHost string
+	}{
+		{
+			name: "Basic HTTP request",
+			setupRequest: func() (*http.Request, http.ResponseWriter) {
+				req := httptest.NewRequest("GET", "http://example.com/test", nil)
+				rw := httptest.NewRecorder()
+				return req, rw
+			},
+			redirectPath: "/callback",
+			expectedURL:  "http://example.com/callback",
+			expectedHost: "example.com",
+		},
+		{
+			name: "HTTPS request with TLS",
+			setupRequest: func() (*http.Request, http.ResponseWriter) {
+				req := httptest.NewRequest("GET", "https://secure.com/test", nil)
+				req.TLS = &tls.ConnectionState{} // Simulate TLS
+				rw := httptest.NewRecorder()
+				return req, rw
+			},
+			redirectPath: "/auth",
+			expectedURL:  "https://secure.com/auth",
+			expectedHost: "secure.com",
+		},
+		{
+			name: "Request with X-Forwarded-Proto header",
+			setupRequest: func() (*http.Request, http.ResponseWriter) {
+				req := httptest.NewRequest("GET", "http://internal.com/test", nil)
+				req.Header.Set("X-Forwarded-Proto", "https")
+				rw := httptest.NewRecorder()
+				return req, rw
+			},
+			redirectPath: "/callback",
+			expectedURL:  "https://internal.com/callback",
+			expectedHost: "internal.com",
+		},
+		{
+			name: "Request with X-Forwarded-Host header",
+			setupRequest: func() (*http.Request, http.ResponseWriter) {
+				req := httptest.NewRequest("GET", "http://internal.com/test", nil)
+				req.Header.Set("X-Forwarded-Host", "public.com")
+				rw := httptest.NewRecorder()
+				return req, rw
+			},
+			redirectPath: "/callback",
+			expectedURL:  "http://public.com/callback",
+			expectedHost: "public.com",
+		},
+		{
+			name: "Request with both forwarded headers",
+			setupRequest: func() (*http.Request, http.ResponseWriter) {
+				req := httptest.NewRequest("GET", "http://internal.com/test", nil)
+				req.Header.Set("X-Forwarded-Proto", "https")
+				req.Header.Set("X-Forwarded-Host", "public.com")
+				rw := httptest.NewRecorder()
+				return req, rw
+			},
+			redirectPath: "/auth",
+			expectedURL:  "https://public.com/auth",
+			expectedHost: "public.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req, rw := tt.setupRequest()
+			ctx := processor.BuildRequestContext(rw, req, tt.redirectPath)
+
+			if ctx == nil {
+				t.Error("Expected BuildRequestContext to return non-nil context")
+				return
+			}
+
+			if ctx.Writer != rw {
+				t.Error("Expected context writer to match provided writer")
+			}
+
+			if ctx.Request != req {
+				t.Error("Expected context request to match provided request")
+			}
+
+			if ctx.RedirectURL != tt.expectedURL {
+				t.Errorf("Expected redirect URL '%s', got '%s'", tt.expectedURL, ctx.RedirectURL)
+			}
+
+			if ctx.Host != tt.expectedHost {
+				t.Errorf("Expected host '%s', got '%s'", tt.expectedHost, ctx.Host)
+			}
+		})
+	}
+}
+
+// TestIsHealthCheckRequest tests health check detection
+func TestIsHealthCheckRequest(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	tests := []struct {
+		name     string
+		path     string
+		expected bool
+	}{
+		{
+			name:     "Health check path",
+			path:     "/health",
+			expected: true,
+		},
+		{
+			name:     "Health check subpath",
+			path:     "/health/status",
+			expected: true,
+		},
+		{
+			name:     "Health check with query params",
+			path:     "/health?check=db",
+			expected: true,
+		},
+		{
+			name:     "Not a health check",
+			path:     "/api/users",
+			expected: false,
+		},
+		{
+			name:     "Health-related path (matches prefix)",
+			path:     "/healthiness",
+			expected: true, // HasPrefix behavior - this actually matches
+		},
+		{
+			name:     "Root path",
+			path:     "/",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com"+tt.path, nil)
+			result := processor.IsHealthCheckRequest(req)
+
+			if result != tt.expected {
+				t.Errorf("Expected IsHealthCheckRequest to return %v for path '%s', got %v", tt.expected, tt.path, result)
+			}
+		})
+	}
+}
+
+// TestIsEventStreamRequest tests event stream detection
+func TestIsEventStreamRequest(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	tests := []struct {
+		name         string
+		acceptHeader string
+		expected     bool
+	}{
+		{
+			name:         "Event stream accept header",
+			acceptHeader: "text/event-stream",
+			expected:     true,
+		},
+		{
+			name:         "Event stream with other types",
+			acceptHeader: "text/html, text/event-stream, application/json",
+			expected:     true,
+		},
+		{
+			name:         "JSON accept header",
+			acceptHeader: "application/json",
+			expected:     false,
+		},
+		{
+			name:         "HTML accept header",
+			acceptHeader: "text/html,application/xhtml+xml",
+			expected:     false,
+		},
+		{
+			name:         "Empty accept header",
+			acceptHeader: "",
+			expected:     false,
+		},
+		{
+			name:         "Similar but not event stream",
+			acceptHeader: "text/event-source",
+			expected:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com/test", nil)
+			if tt.acceptHeader != "" {
+				req.Header.Set("Accept", tt.acceptHeader)
+			}
+
+			result := processor.IsEventStreamRequest(req)
+
+			if result != tt.expected {
+				t.Errorf("Expected IsEventStreamRequest to return %v for accept header '%s', got %v", tt.expected, tt.acceptHeader, result)
+			}
+		})
+	}
+}
+
+// TestIsAjaxRequest tests AJAX request detection
+func TestIsAjaxRequest(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	tests := []struct {
+		name        string
+		setupHeader func(*http.Request)
+		expected    bool
+	}{
+		{
+			name: "XMLHttpRequest header",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("X-Requested-With", "XMLHttpRequest")
+			},
+			expected: true,
+		},
+		{
+			name: "JSON content type",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("Content-Type", "application/json")
+			},
+			expected: true,
+		},
+		{
+			name: "JSON content type with charset",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("Content-Type", "application/json; charset=utf-8")
+			},
+			expected: true,
+		},
+		{
+			name: "JSON accept header",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("Accept", "application/json")
+			},
+			expected: true,
+		},
+		{
+			name: "JSON accept with other types",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("Accept", "text/html, application/json, application/xml")
+			},
+			expected: true,
+		},
+		{
+			name: "Multiple AJAX indicators",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("X-Requested-With", "XMLHttpRequest")
+				req.Header.Set("Content-Type", "application/json")
+				req.Header.Set("Accept", "application/json")
+			},
+			expected: true,
+		},
+		{
+			name: "Regular HTML request",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("Accept", "text/html,application/xhtml+xml")
+			},
+			expected: false,
+		},
+		{
+			name: "Form submission",
+			setupHeader: func(req *http.Request) {
+				req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			},
+			expected: false,
+		},
+		{
+			name:        "No special headers",
+			setupHeader: func(req *http.Request) {},
+			expected:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("POST", "http://example.com/api", nil)
+			tt.setupHeader(req)
+
+			result := processor.IsAjaxRequest(req)
+
+			if result != tt.expected {
+				t.Errorf("Expected IsAjaxRequest to return %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestWaitForInitialization tests initialization waiting
+func TestWaitForInitialization(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	t.Run("Initialization completes successfully", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "http://example.com/test", nil)
+		initComplete := make(chan struct{})
+
+		go func() {
+			time.Sleep(10 * time.Millisecond)
+			close(initComplete)
+		}()
+
+		err := processor.WaitForInitialization(req, initComplete)
+		if err != nil {
+			t.Errorf("Expected no error when initialization completes, got: %v", err)
+		}
+	})
+
+	t.Run("Request context cancelled", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		req := httptest.NewRequest("GET", "http://example.com/test", nil)
+		req = req.WithContext(ctx)
+		initComplete := make(chan struct{})
+
+		go func() {
+			time.Sleep(10 * time.Millisecond)
+			cancel()
+		}()
+
+		err := processor.WaitForInitialization(req, initComplete)
+		if err == nil {
+			t.Error("Expected error when request context is cancelled")
+		}
+
+		if !strings.Contains(err.Error(), "request cancelled") {
+			t.Errorf("Expected 'request cancelled' error, got: %v", err)
+		}
+
+		if len(logger.DebugCalls) == 0 {
+			t.Error("Expected debug log when request is cancelled")
+		}
+	})
+
+	t.Run("Initialization timeout", func(t *testing.T) {
+		if testing.Short() {
+			t.Skip("Skipping timeout test in short mode")
+		}
+
+		req := httptest.NewRequest("GET", "http://example.com/test", nil)
+		initComplete := make(chan struct{}) // Never closes
+
+		// Note: This test takes 30 seconds due to hardcoded timeout in implementation
+		start := time.Now()
+		err := processor.WaitForInitialization(req, initComplete)
+		duration := time.Since(start)
+
+		if err == nil {
+			t.Error("Expected timeout error")
+		}
+
+		if !strings.Contains(err.Error(), "timeout") {
+			t.Errorf("Expected timeout error, got: %v", err)
+		}
+
+		// The timeout should be around 30 seconds, allow some variance
+		if duration < 29*time.Second || duration > 31*time.Second {
+			t.Errorf("Expected timeout after ~30 seconds, but got %v", duration)
+		}
+
+		if len(logger.ErrorCalls) == 0 {
+			t.Error("Expected error log when timeout occurs")
+		}
+	})
+}
+
+// TestDetermineScheme tests scheme determination
+func TestDetermineScheme(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	tests := []struct {
+		name     string
+		setup    func(*http.Request)
+		expected string
+	}{
+		{
+			name: "X-Forwarded-Proto HTTPS",
+			setup: func(req *http.Request) {
+				req.Header.Set("X-Forwarded-Proto", "https")
+			},
+			expected: "https",
+		},
+		{
+			name: "X-Forwarded-Proto HTTP",
+			setup: func(req *http.Request) {
+				req.Header.Set("X-Forwarded-Proto", "http")
+			},
+			expected: "http",
+		},
+		{
+			name: "TLS connection without header",
+			setup: func(req *http.Request) {
+				req.TLS = &tls.ConnectionState{}
+			},
+			expected: "https",
+		},
+		{
+			name: "No TLS, no header",
+			setup: func(req *http.Request) {
+				// No special setup
+			},
+			expected: "http",
+		},
+		{
+			name: "X-Forwarded-Proto takes precedence over TLS",
+			setup: func(req *http.Request) {
+				req.Header.Set("X-Forwarded-Proto", "http")
+				req.TLS = &tls.ConnectionState{}
+			},
+			expected: "http",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com/test", nil)
+			tt.setup(req)
+
+			result := processor.determineScheme(req)
+
+			if result != tt.expected {
+				t.Errorf("Expected scheme '%s', got '%s'", tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestDetermineHost tests host determination
+func TestDetermineHost(t *testing.T) {
+	logger := &MockLogger{}
+	processor := NewRequestProcessor(logger)
+
+	tests := []struct {
+		name     string
+		setup    func(*http.Request)
+		expected string
+	}{
+		{
+			name: "X-Forwarded-Host header present",
+			setup: func(req *http.Request) {
+				req.Header.Set("X-Forwarded-Host", "public.example.com")
+			},
+			expected: "public.example.com",
+		},
+		{
+			name: "No X-Forwarded-Host, use req.Host",
+			setup: func(req *http.Request) {
+				// No special setup, will use req.Host
+			},
+			expected: "example.com",
+		},
+		{
+			name: "Empty X-Forwarded-Host, fallback to req.Host",
+			setup: func(req *http.Request) {
+				req.Header.Set("X-Forwarded-Host", "")
+			},
+			expected: "example.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com/test", nil)
+			tt.setup(req)
+
+			result := processor.determineHost(req)
+
+			if result != tt.expected {
+				t.Errorf("Expected host '%s', got '%s'", tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestBuildFullURL tests URL building
+func TestBuildFullURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		scheme   string
+		host     string
+		path     string
+		expected string
+	}{
+		{
+			name:     "Basic URL construction",
+			scheme:   "https",
+			host:     "example.com",
+			path:     "/callback",
+			expected: "https://example.com/callback",
+		},
+		{
+			name:     "Path without leading slash",
+			scheme:   "http",
+			host:     "test.com",
+			path:     "auth",
+			expected: "http://test.com/auth",
+		},
+		{
+			name:     "Absolute HTTP URL in path",
+			scheme:   "https",
+			host:     "example.com",
+			path:     "http://other.com/callback",
+			expected: "http://other.com/callback",
+		},
+		{
+			name:     "Absolute HTTPS URL in path",
+			scheme:   "http",
+			host:     "example.com",
+			path:     "https://secure.com/auth",
+			expected: "https://secure.com/auth",
+		},
+		{
+			name:     "Root path",
+			scheme:   "https",
+			host:     "example.com:8080",
+			path:     "/",
+			expected: "https://example.com:8080/",
+		},
+		{
+			name:     "Empty path",
+			scheme:   "https",
+			host:     "example.com",
+			path:     "",
+			expected: "https://example.com/",
+		},
+		{
+			name:     "Path with query parameters",
+			scheme:   "https",
+			host:     "example.com",
+			path:     "/callback?state=abc123",
+			expected: "https://example.com/callback?state=abc123",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := buildFullURL(tt.scheme, tt.host, tt.path)
+
+			if result != tt.expected {
+				t.Errorf("Expected URL '%s', got '%s'", tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestRequestContext tests the RequestContext struct
+func TestRequestContext(t *testing.T) {
+	req := httptest.NewRequest("GET", "http://example.com/test", nil)
+	rw := httptest.NewRecorder()
+
+	ctx := &RequestContext{
+		Writer:      rw,
+		Request:     req,
+		RedirectURL: "https://example.com/callback",
+		Scheme:      "https",
+		Host:        "example.com",
+	}
+
+	if ctx.Writer != rw {
+		t.Error("Expected Writer to be set correctly")
+	}
+
+	if ctx.Request != req {
+		t.Error("Expected Request to be set correctly")
+	}
+
+	if ctx.RedirectURL != "https://example.com/callback" {
+		t.Error("Expected RedirectURL to be set correctly")
+	}
+
+	if ctx.Scheme != "https" {
+		t.Error("Expected Scheme to be set correctly")
+	}
+
+	if ctx.Host != "example.com" {
+		t.Error("Expected Host to be set correctly")
+	}
+}

internal/optimization/memory_pool.go

@@ -1,95 +0,0 @@
-// Package optimization provides memory and performance optimizations
-package optimization
-
-import (
-	"sync"
-)
-
-// StringBuilderPool provides a pool of reusable string builders
-type StringBuilderPool struct {
-	pool sync.Pool
-}
-
-// NewStringBuilderPool creates a new string builder pool
-func NewStringBuilderPool() *StringBuilderPool {
-	return &StringBuilderPool{
-		pool: sync.Pool{
-			New: func() any {
-				buf := make([]byte, 0, 256) // Pre-allocate 256 bytes
-				return &buf
-			},
-		},
-	}
-}
-
-// Get retrieves a string builder from the pool
-func (p *StringBuilderPool) Get() []byte {
-	bufPtr := p.pool.Get().(*[]byte)
-	return *bufPtr
-}
-
-// Put returns a string builder to the pool
-func (p *StringBuilderPool) Put(buf []byte) {
-	if cap(buf) < 4096 { // Don't pool overly large buffers
-		buf = buf[:0] // Reset length but keep capacity
-		p.pool.Put(&buf)
-	}
-}
-
-// ByteSlicePool provides a pool of reusable byte slices
-type ByteSlicePool struct {
-	pool sync.Pool
-	size int
-}
-
-// NewByteSlicePool creates a new byte slice pool with specified size
-func NewByteSlicePool(size int) *ByteSlicePool {
-	return &ByteSlicePool{
-		size: size,
-		pool: sync.Pool{
-			New: func() any {
-				buf := make([]byte, size)
-				return &buf
-			},
-		},
-	}
-}
-
-// Get retrieves a byte slice from the pool
-func (p *ByteSlicePool) Get() []byte {
-	bufPtr := p.pool.Get().(*[]byte)
-	return *bufPtr
-}
-
-// Put returns a byte slice to the pool
-func (p *ByteSlicePool) Put(buf []byte) {
-	if len(buf) == p.size {
-		p.pool.Put(&buf)
-	}
-}
-
-// Global pools for common use cases
-var (
-	globalStringBuilderPool = NewStringBuilderPool()
-	globalByteSlicePool     = NewByteSlicePool(2048)
-)
-
-// GetStringBuilder gets a string builder from the global pool
-func GetStringBuilder() []byte {
-	return globalStringBuilderPool.Get()
-}
-
-// PutStringBuilder returns a string builder to the global pool
-func PutStringBuilder(buf []byte) {
-	globalStringBuilderPool.Put(buf)
-}
-
-// GetByteSlice gets a byte slice from the global pool
-func GetByteSlice() []byte {
-	return globalByteSlicePool.Get()
-}
-
-// PutByteSlice returns a byte slice to the global pool
-func PutByteSlice(buf []byte) {
-	globalByteSlicePool.Put(buf)
-}

internal/patterns/regex_cache_test.go

@@ -142,6 +142,66 @@ func TestValidationFunctions(t *testing.T) {
 			valid:    []string{"client123", "my-client_id", "123.456"},
 			invalid:  []string{"", "client with spaces", "client@invalid"},
 		},
+		{
+			name:     "ValidateURL",
+			function: ValidateURL,
+			valid:    []string{"https://example.com", "https://sub.domain.org/path", "http://localhost", "https://example.com/path?query=value", "http://192.168.1.1"},
+			invalid:  []string{"", "ftp://example.com", "not-a-url", "https://", "example.com", "http://localhost:8080"},
+		},
+		{
+			name:     "ValidateScopes",
+			function: ValidateScopes,
+			valid:    []string{"openid", "openid profile", "read write admin", "user_info"},
+			invalid:  []string{"", "scope-with-dash", "scope@invalid", "scope with.dot", "  "},
+		},
+		{
+			name:     "ValidateSessionID",
+			function: ValidateSessionID,
+			valid:    []string{"a1b2c3d4e5f6789012345678901234567890abcdef", "ABCDEF1234567890abcdef1234567890", "0123456789abcdef0123456789abcdef"},
+			invalid:  []string{"", "too-short", "contains-invalid-chars!", "g123456789abcdef0123456789abcdef", "1234567890abcdef1234567890abcde"},
+		},
+		{
+			name:     "ValidateCSRFToken",
+			function: ValidateCSRFToken,
+			valid:    []string{"abc123", "ABC_123-xyz", "token-value_123", "_valid-token_"},
+			invalid:  []string{"", "token with spaces", "token@invalid", "token.with.dots!", "token/with/slash"},
+		},
+		{
+			name:     "ValidateNonce",
+			function: ValidateNonce,
+			valid:    []string{"abc123", "ABC_123-xyz", "nonce-value_123", "_valid-nonce_"},
+			invalid:  []string{"", "nonce with spaces", "nonce@invalid", "nonce.with.dots!", "nonce/with/slash"},
+		},
+		{
+			name:     "ValidateCodeVerifier",
+			function: ValidateCodeVerifier,
+			valid:    []string{"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-"},
+			invalid:  []string{"", "too-short", "short", "verifier with spaces", "verifier@invalid", "a"},
+		},
+		{
+			name:     "ValidateAuthCode",
+			function: ValidateAuthCode,
+			valid:    []string{"auth_code_123", "ABC.123-xyz/code+value=", "simple-code"},
+			invalid:  []string{"", "code with spaces", "code@invalid"},
+		},
+		{
+			name:     "ValidateRedirectURI",
+			function: ValidateRedirectURI,
+			valid:    []string{"https://example.com/callback", "http://localhost:8080/auth", "https://app.example.org/oauth/callback", "http://127.0.0.1:3000"},
+			invalid:  []string{"", "ftp://example.com", "not-a-url", "example.com/callback", "https://"},
+		},
+		{
+			name:     "ValidateIPv4",
+			function: ValidateIPv4,
+			valid:    []string{"192.168.1.1", "10.0.0.1", "127.0.0.1", "255.255.255.255", "0.0.0.0"},
+			invalid:  []string{"", "256.1.1.1", "192.168.1", "192.168.1.1.1", "not-an-ip"},
+		},
+		{
+			name:     "ValidateTenantID",
+			function: ValidateTenantID,
+			valid:    []string{"12345678-1234-1234-1234-123456789abc", "ABCDEF12-3456-7890-ABCD-EF1234567890"},
+			invalid:  []string{"", "not-a-uuid", "12345678-1234-1234-1234", "12345678-1234-1234-1234-123456789abcd", "123456781234123412341234567890ab"},
+		},
 	}
 
 	for _, tt := range tests {
@@ -223,3 +283,202 @@ func BenchmarkRegex_DirectCompile(b *testing.B) {
 		}
 	}
 }
+
+func TestRegexCache_Clear(t *testing.T) {
+	cache := NewRegexCache()
+
+	// Add some patterns to the cache
+	patterns := []string{`^test1$`, `^test2$`, `^test3$`}
+	for _, pattern := range patterns {
+		_, err := cache.Get(pattern)
+		if err != nil {
+			t.Fatalf("Failed to add pattern %s: %v", pattern, err)
+		}
+	}
+
+	// Verify cache has patterns
+	if cache.Size() != 3 {
+		t.Errorf("Expected cache size 3, got %d", cache.Size())
+	}
+
+	// Clear the cache
+	cache.Clear()
+
+	// Verify cache is empty
+	if cache.Size() != 0 {
+		t.Errorf("Expected cache size 0 after clear, got %d", cache.Size())
+	}
+}
+
+func TestIsBotUserAgent(t *testing.T) {
+	tests := []struct {
+		userAgent string
+		isBot     bool
+	}{
+		{"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", true},
+		{"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)", true},
+		{"facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)", false},
+		{"crawler-bot/1.0", true},
+		{"spider-agent/2.0", true},
+		{"curl/7.68.0", true},
+		{"wget/1.20.3", true},
+		{"python-requests/2.25.1", true},
+		{"Go-http-client/1.1", true},
+		{"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", false},
+		{"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36", false},
+		{"", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.userAgent, func(t *testing.T) {
+			result := IsBotUserAgent(tt.userAgent)
+			if result != tt.isBot {
+				t.Errorf("IsBotUserAgent(%q) = %v, want %v", tt.userAgent, result, tt.isBot)
+			}
+		})
+	}
+}
+
+func TestGetGlobalCache(t *testing.T) {
+	cache := GetGlobalCache()
+	if cache == nil {
+		t.Error("GetGlobalCache() should not return nil")
+	}
+
+	// Should return the same instance
+	cache2 := GetGlobalCache()
+	if cache != cache2 {
+		t.Error("GetGlobalCache() should return the same instance")
+	}
+
+	// Should have precompiled patterns
+	if cache.Size() == 0 {
+		t.Error("Global cache should have precompiled patterns")
+	}
+}
+
+func TestCompilePattern(t *testing.T) {
+	pattern := `^test_compile\d+$`
+
+	regex, err := CompilePattern(pattern)
+	if err != nil {
+		t.Fatalf("CompilePattern failed: %v", err)
+	}
+
+	if !regex.MatchString("test_compile123") {
+		t.Error("Compiled pattern should match 'test_compile123'")
+	}
+
+	if regex.MatchString("test_compile") {
+		t.Error("Compiled pattern should not match 'test_compile'")
+	}
+
+	// Test invalid pattern
+	_, err = CompilePattern(`[invalid`)
+	if err == nil {
+		t.Error("Expected error for invalid pattern")
+	}
+}
+
+func TestMustCompilePattern(t *testing.T) {
+	pattern := `^test_must_compile\d+$`
+
+	regex := MustCompilePattern(pattern)
+	if regex == nil {
+		t.Fatal("MustCompilePattern should not return nil")
+	}
+
+	if !regex.MatchString("test_must_compile456") {
+		t.Error("Compiled pattern should match 'test_must_compile456'")
+	}
+
+	// Test that it panics with invalid pattern
+	defer func() {
+		if r := recover(); r == nil {
+			t.Error("MustCompilePattern should panic with invalid pattern")
+		}
+	}()
+	MustCompilePattern(`[invalid`)
+}
+
+func TestAdditionalValidationEdgeCases(t *testing.T) {
+	// Test edge cases for ValidateURL
+	t.Run("ValidateURL_EdgeCases", func(t *testing.T) {
+		edgeCases := []struct {
+			url   string
+			valid bool
+		}{
+			{"https://a.b", true},
+			{"http://localhost", true},
+			{"https://example.com/path?query=value#fragment", true},
+			{"http://192.168.0.1:8080/api", false},
+			{"https://", false},
+			{"http://", false},
+			{"https://example", true},
+		}
+
+		for _, tc := range edgeCases {
+			result := ValidateURL(tc.url)
+			if result != tc.valid {
+				t.Errorf("ValidateURL(%q) = %v, want %v", tc.url, result, tc.valid)
+			}
+		}
+	})
+
+	// Test edge cases for ValidateScopes
+	t.Run("ValidateScopes_EdgeCases", func(t *testing.T) {
+		edgeCases := []struct {
+			scopes string
+			valid  bool
+		}{
+			{"a", true},
+			{"a b", true},
+			{"openid profile email", true},
+			{"user_profile", true},
+			{"read_all write_all", true},
+			{"scope-with-dash", false},
+			{"scope.with.dot", false},
+			{"scope@email", false},
+			{" scope", false},
+			{"scope ", false},
+			{"a  b", true}, // pattern allows multiple spaces
+		}
+
+		for _, tc := range edgeCases {
+			result := ValidateScopes(tc.scopes)
+			if result != tc.valid {
+				t.Errorf("ValidateScopes(%q) = %v, want %v", tc.scopes, result, tc.valid)
+			}
+		}
+	})
+
+	// Test edge cases for ValidateSessionID
+	t.Run("ValidateSessionID_EdgeCases", func(t *testing.T) {
+		edgeCases := []struct {
+			sessionID string
+			valid     bool
+		}{
+			{"12345678901234567890123456789012", true},                             // 32 chars (min)
+			{"1234567890123456789012345678901", false},                             // 31 chars (too short)
+			{string(make([]byte, 128)), false},                                     // 128 non-hex chars
+			{"abcdef1234567890ABCDEF1234567890" + string(make([]byte, 96)), false}, // 128+ chars with non-hex
+		}
+
+		// Generate valid 128-char hex string (max length)
+		validLongHex := ""
+		for i := 0; i < 128; i++ {
+			validLongHex += "a"
+		}
+		edgeCases = append(edgeCases, struct {
+			sessionID string
+			valid     bool
+		}{validLongHex, true})
+
+		for _, tc := range edgeCases {
+			result := ValidateSessionID(tc.sessionID)
+			if result != tc.valid {
+				t.Errorf("ValidateSessionID(%q) = %v, want %v", tc.sessionID, result, tc.valid)
+			}
+		}
+	})
+}

internal/pool/pool.go

@@ -6,6 +6,8 @@ package pool
 import (
 	"bytes"
 	"compress/gzip"
+	"encoding/json"
+	"io"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -54,6 +56,10 @@ type PoolStats struct {
 	JWTPuts          uint64
 	HTTPGets         uint64
 	HTTPPuts         uint64
+	JSONEncoderGets  uint64
+	JSONEncoderPuts  uint64
+	JSONDecoderGets  uint64
+	JSONDecoderPuts  uint64
 	OversizedRejects uint64
 }
 
@@ -378,6 +384,40 @@ func (m *Manager) PutByteSlice(b []byte) {
 	}
 }
 
+// GetJSONEncoder returns a JSON encoder from the pool configured for the given writer
+func (m *Manager) GetJSONEncoder(w io.Writer) *json.Encoder {
+	atomic.AddUint64(&m.stats.JSONEncoderGets, 1)
+	// Since json.Encoder doesn't support resetting, we create new ones each time
+	encoder := json.NewEncoder(w)
+	encoder.SetEscapeHTML(false) // Disable HTML escaping for performance
+	return encoder
+}
+
+// PutJSONEncoder returns a JSON encoder to the pool
+func (m *Manager) PutJSONEncoder(encoder *json.Encoder) {
+	if encoder == nil {
+		return
+	}
+	atomic.AddUint64(&m.stats.JSONEncoderPuts, 1)
+	// JSON encoders can't be reset, so we don't pool them
+}
+
+// GetJSONDecoder returns a JSON decoder from the pool configured for the given reader
+func (m *Manager) GetJSONDecoder(r io.Reader) *json.Decoder {
+	atomic.AddUint64(&m.stats.JSONDecoderGets, 1)
+	// Since json.Decoder doesn't support resetting, we create new ones each time
+	return json.NewDecoder(r)
+}
+
+// PutJSONDecoder returns a JSON decoder to the pool
+func (m *Manager) PutJSONDecoder(decoder *json.Decoder) {
+	if decoder == nil {
+		return
+	}
+	atomic.AddUint64(&m.stats.JSONDecoderPuts, 1)
+	// JSON decoders can't be reset, so we don't pool them
+}
+
 // GetStats returns current pool statistics
 func (m *Manager) GetStats() PoolStats {
 	return PoolStats{
@@ -391,6 +431,10 @@ func (m *Manager) GetStats() PoolStats {
 		JWTPuts:          atomic.LoadUint64(&m.stats.JWTPuts),
 		HTTPGets:         atomic.LoadUint64(&m.stats.HTTPGets),
 		HTTPPuts:         atomic.LoadUint64(&m.stats.HTTPPuts),
+		JSONEncoderGets:  atomic.LoadUint64(&m.stats.JSONEncoderGets),
+		JSONEncoderPuts:  atomic.LoadUint64(&m.stats.JSONEncoderPuts),
+		JSONDecoderGets:  atomic.LoadUint64(&m.stats.JSONDecoderGets),
+		JSONDecoderPuts:  atomic.LoadUint64(&m.stats.JSONDecoderPuts),
 		OversizedRejects: atomic.LoadUint64(&m.stats.OversizedRejects),
 	}
 }
@@ -407,6 +451,10 @@ func (m *Manager) ResetStats() {
 	atomic.StoreUint64(&m.stats.JWTPuts, 0)
 	atomic.StoreUint64(&m.stats.HTTPGets, 0)
 	atomic.StoreUint64(&m.stats.HTTPPuts, 0)
+	atomic.StoreUint64(&m.stats.JSONEncoderGets, 0)
+	atomic.StoreUint64(&m.stats.JSONEncoderPuts, 0)
+	atomic.StoreUint64(&m.stats.JSONDecoderGets, 0)
+	atomic.StoreUint64(&m.stats.JSONDecoderPuts, 0)
 	atomic.StoreUint64(&m.stats.OversizedRejects, 0)
 }
 
@@ -471,3 +519,23 @@ func ByteSlice(size int) []byte {
 func ReturnByteSlice(b []byte) {
 	Get().PutByteSlice(b)
 }
+
+// JSONEncoder returns a JSON encoder from the global pool
+func JSONEncoder(w io.Writer) *json.Encoder {
+	return Get().GetJSONEncoder(w)
+}
+
+// ReturnJSONEncoder returns a JSON encoder to the global pool
+func ReturnJSONEncoder(encoder *json.Encoder) {
+	Get().PutJSONEncoder(encoder)
+}
+
+// JSONDecoder returns a JSON decoder from the global pool
+func JSONDecoder(r io.Reader) *json.Decoder {
+	return Get().GetJSONDecoder(r)
+}
+
+// ReturnJSONDecoder returns a JSON decoder to the global pool
+func ReturnJSONDecoder(decoder *json.Decoder) {
+	Get().PutJSONDecoder(decoder)
+}

internal/pool/utils.go

@@ -0,0 +1,70 @@
+// Package pool provides centralized memory pool management utilities
+package pool
+
+import (
+	"strings"
+)
+
+// BuildSessionName efficiently builds session names using pooled string builders
+func BuildSessionName(baseName string, index int) string {
+	sb := StringBuilder()
+	defer ReturnStringBuilder(sb)
+
+	sb.WriteString(baseName)
+	sb.WriteRune('_')
+	// Efficient int to string conversion
+	if index < 10 {
+		sb.WriteRune('0' + rune(index))
+	} else {
+		sb.WriteString(intToString(index))
+	}
+
+	return sb.String()
+}
+
+// BuildCacheKey efficiently builds cache keys using pooled string builders
+func BuildCacheKey(parts ...string) string {
+	sb := StringBuilder()
+	defer ReturnStringBuilder(sb)
+
+	for i, part := range parts {
+		if i > 0 {
+			sb.WriteRune(':')
+		}
+		sb.WriteString(part)
+	}
+
+	return sb.String()
+}
+
+// FormatString efficiently formats a string using a pooled string builder
+func FormatString(format func(*strings.Builder)) string {
+	sb := StringBuilder()
+	defer ReturnStringBuilder(sb)
+	format(sb)
+	return sb.String()
+}
+
+// intToString converts int to string without allocation (for small numbers)
+func intToString(n int) string {
+	if n < 0 {
+		return "-" + intToString(-n)
+	}
+	if n < 10 {
+		return string(rune('0' + n))
+	}
+	if n < 100 {
+		return string(rune('0'+n/10)) + string(rune('0'+n%10))
+	}
+	// Fall back to standard conversion for larger numbers
+	buf := make([]byte, 0, 20)
+	for n > 0 {
+		buf = append(buf, byte('0'+n%10))
+		n /= 10
+	}
+	// Reverse the buffer
+	for i, j := 0, len(buf)-1; i < j; i, j = i+1, j-1 {
+		buf[i], buf[j] = buf[j], buf[i]
+	}
+	return string(buf)
+}

internal/token/verifier.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"strings"
 	"time"
+
+	traefikoidc "github.com/lukaszraczylo/traefikoidc"
 )
 
 // Verifier handles token verification operations
@@ -30,7 +32,7 @@ type TokenCache interface {
 
 // JWKCache interface for key management
 type JWKCache interface {
-	GetJWKS(providerURL string) (*JWKS, error)
+	GetJWKS(providerURL string) (*traefikoidc.JWKSet, error)
 }
 
 // RateLimiter interface for request limiting
@@ -44,20 +46,6 @@ type Logger interface {
 	Errorf(format string, args ...interface{})
 }
 
-// JWKS represents JSON Web Key Set
-type JWKS struct {
-	Keys []JWK `json:"keys"`
-}
-
-// JWK represents a JSON Web Key
-type JWK struct {
-	Kid string `json:"kid"`
-	Kty string `json:"kty"`
-	Use string `json:"use"`
-	N   string `json:"n"`
-	E   string `json:"e"`
-}
-
 // JWT represents a parsed JWT token
 type JWT struct {
 	Header map[string]interface{}

internal/token/verifier_test.go

@@ -0,0 +1,457 @@
+package token
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	traefikoidc "github.com/lukaszraczylo/traefikoidc"
+)
+
+// Mock implementations for testing
+type MockTokenCache struct {
+	data map[string]map[string]interface{}
+}
+
+func (m *MockTokenCache) Get(key string) (map[string]interface{}, bool) {
+	if m.data == nil {
+		return nil, false
+	}
+	value, exists := m.data[key]
+	return value, exists
+}
+
+func (m *MockTokenCache) Set(key string, claims map[string]interface{}, ttl time.Duration) {
+	if m.data == nil {
+		m.data = make(map[string]map[string]interface{})
+	}
+	m.data[key] = claims
+}
+
+type MockCache struct {
+	data map[string]interface{}
+}
+
+func (m *MockCache) Get(key string) (interface{}, bool) {
+	if m.data == nil {
+		return nil, false
+	}
+	value, exists := m.data[key]
+	return value, exists
+}
+
+func (m *MockCache) Set(key string, value interface{}, ttl time.Duration) {
+	if m.data == nil {
+		m.data = make(map[string]interface{})
+	}
+	m.data[key] = value
+}
+
+type MockJWKCache struct{}
+
+func (m *MockJWKCache) GetJWKS(providerURL string) (*traefikoidc.JWKSet, error) {
+	return &traefikoidc.JWKSet{
+		Keys: []traefikoidc.JWK{
+			{
+				Kid: "test-key",
+				Kty: "RSA",
+				Use: "sig",
+				Alg: "RS256",
+			},
+		},
+	}, nil
+}
+
+type MockRateLimiter struct {
+	allow bool
+}
+
+func (m *MockRateLimiter) Allow() bool {
+	return m.allow
+}
+
+type MockLogger struct {
+	debugMessages []string
+	errorMessages []string
+}
+
+func (m *MockLogger) Debugf(format string, args ...interface{}) {
+	m.debugMessages = append(m.debugMessages, format)
+}
+
+func (m *MockLogger) Errorf(format string, args ...interface{}) {
+	m.errorMessages = append(m.errorMessages, format)
+}
+
+func TestNewVerifier(t *testing.T) {
+	tokenCache := &MockTokenCache{}
+	tokenBlacklist := &MockCache{}
+	jwkCache := &MockJWKCache{}
+	limiter := &MockRateLimiter{allow: true}
+	logger := &MockLogger{}
+
+	verifier := NewVerifier(tokenCache, tokenBlacklist, jwkCache, limiter, logger)
+
+	if verifier == nil {
+		t.Fatal("NewVerifier returned nil")
+	}
+
+	if verifier.tokenCache != tokenCache {
+		t.Error("TokenCache not set correctly")
+	}
+
+	if verifier.tokenBlacklist != tokenBlacklist {
+		t.Error("TokenBlacklist not set correctly")
+	}
+
+	// Note: Interface comparison would require reflecting on the actual implementation
+	// For now, we just check that the field was set to something non-nil
+	if verifier.jwkCache == nil {
+		t.Error("JWKCache not set correctly")
+	}
+
+	if verifier.limiter != limiter {
+		t.Error("RateLimiter not set correctly")
+	}
+
+	if verifier.logger != logger {
+		t.Error("Logger not set correctly")
+	}
+}
+
+func TestVerifierBasicFunctionality(t *testing.T) {
+	tokenCache := &MockTokenCache{}
+	tokenBlacklist := &MockCache{}
+	jwkCache := &MockJWKCache{}
+	limiter := &MockRateLimiter{allow: true}
+	logger := &MockLogger{}
+
+	verifier := NewVerifier(tokenCache, tokenBlacklist, jwkCache, limiter, logger)
+
+	// Test that the verifier was created successfully
+	if verifier == nil {
+		t.Fatal("Expected non-nil verifier")
+	}
+}
+
+func TestJWKSStructure(t *testing.T) {
+	jwks := &traefikoidc.JWKSet{
+		Keys: []traefikoidc.JWK{
+			{
+				Kid: "test-key-1",
+				Kty: "RSA",
+				Use: "sig",
+				Alg: "RS256",
+			},
+			{
+				Kid: "test-key-2",
+				Kty: "RSA",
+				Use: "sig",
+				Alg: "RS256",
+			},
+		},
+	}
+
+	if len(jwks.Keys) != 2 {
+		t.Errorf("Expected 2 keys, got %d", len(jwks.Keys))
+	}
+
+	if jwks.Keys[0].Kid != "test-key-1" {
+		t.Errorf("Expected Kid 'test-key-1', got '%s'", jwks.Keys[0].Kid)
+	}
+
+	if jwks.Keys[1].Kid != "test-key-2" {
+		t.Errorf("Expected Kid 'test-key-2', got '%s'", jwks.Keys[1].Kid)
+	}
+}
+
+func TestJWKStructure(t *testing.T) {
+	jwk := traefikoidc.JWK{
+		Kid: "test-key",
+		Kty: "RSA",
+		Use: "sig",
+		Alg: "RS256",
+		N:   "test-modulus",
+		E:   "test-exponent",
+	}
+
+	if jwk.Kid != "test-key" {
+		t.Errorf("Expected Kid 'test-key', got '%s'", jwk.Kid)
+	}
+
+	if jwk.Kty != "RSA" {
+		t.Errorf("Expected Kty 'RSA', got '%s'", jwk.Kty)
+	}
+
+	if jwk.Use != "sig" {
+		t.Errorf("Expected Use 'sig', got '%s'", jwk.Use)
+	}
+
+	if jwk.Alg != "RS256" {
+		t.Errorf("Expected Alg 'RS256', got '%s'", jwk.Alg)
+	}
+}
+
+func TestVerifyToken(t *testing.T) {
+	tests := []struct {
+		name           string
+		token          string
+		clientID       string
+		jwksURL        string
+		issuerURL      string
+		rateLimitAllow bool
+		cacheData      map[string]map[string]interface{}
+		blacklistData  map[string]interface{}
+		expectedError  string
+	}{
+		{
+			name:           "Empty token",
+			token:          "",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: true,
+			expectedError:  "invalid JWT format: token is empty",
+		},
+		{
+			name:           "Invalid JWT format - too few parts",
+			token:          "header.payload",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: true,
+			expectedError:  "invalid JWT format: expected JWT with 3 parts, got 2 parts",
+		},
+		{
+			name:           "Invalid JWT format - too many parts",
+			token:          "header.payload.signature.extra",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: true,
+			expectedError:  "invalid JWT format: expected JWT with 3 parts, got 4 parts",
+		},
+		{
+			name:           "Token too short",
+			token:          "a.b.c",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: true,
+			expectedError:  "token too short to be valid JWT",
+		},
+		{
+			name:           "Blacklisted token",
+			token:          "valid.format.token",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: true,
+			blacklistData:  map[string]interface{}{"valid.format.token": true},
+			expectedError:  "token is blacklisted",
+		},
+		{
+			name:           "Cached token - success",
+			token:          "valid.format.token",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: true,
+			cacheData:      map[string]map[string]interface{}{"valid.format.token": {"sub": "user123"}},
+			expectedError:  "",
+		},
+		{
+			name:           "Rate limit exceeded",
+			token:          "valid.format.token",
+			clientID:       "test-client",
+			jwksURL:        "https://example.com/jwks",
+			issuerURL:      "https://example.com",
+			rateLimitAllow: false,
+			expectedError:  "rate limit exceeded",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tokenCache := &MockTokenCache{data: tt.cacheData}
+			tokenBlacklist := &MockCache{data: tt.blacklistData}
+			jwkCache := &MockJWKCache{}
+			limiter := &MockRateLimiter{allow: tt.rateLimitAllow}
+			logger := &MockLogger{}
+
+			verifier := NewVerifier(tokenCache, tokenBlacklist, jwkCache, limiter, logger)
+			err := verifier.VerifyToken(tt.token, tt.clientID, tt.jwksURL, tt.issuerURL)
+
+			if tt.expectedError == "" {
+				if err != nil {
+					t.Errorf("Expected no error, got: %v", err)
+				}
+			} else {
+				if err == nil {
+					t.Errorf("Expected error containing '%s', got nil", tt.expectedError)
+				} else if !strings.Contains(err.Error(), tt.expectedError) {
+					t.Errorf("Expected error containing '%s', got: %v", tt.expectedError, err)
+				}
+			}
+		})
+	}
+}
+
+func TestParseJWT(t *testing.T) {
+	tokenCache := &MockTokenCache{}
+	tokenBlacklist := &MockCache{}
+	jwkCache := &MockJWKCache{}
+	limiter := &MockRateLimiter{allow: true}
+	logger := &MockLogger{}
+
+	verifier := NewVerifier(tokenCache, tokenBlacklist, jwkCache, limiter, logger)
+
+	// Test parseJWT with a valid format token
+	jwt, err := verifier.parseJWT("header.payload.signature")
+	if err != nil {
+		t.Errorf("Expected no error parsing JWT, got: %v", err)
+	}
+
+	if jwt == nil {
+		t.Error("Expected non-nil JWT object")
+		return
+	}
+
+	if jwt.Header == nil {
+		t.Error("Expected non-nil Header map")
+	}
+
+	if jwt.Claims == nil {
+		t.Error("Expected non-nil Claims map")
+	}
+}
+
+func TestVerifyJWTSignatureAndClaims(t *testing.T) {
+	tokenCache := &MockTokenCache{}
+	tokenBlacklist := &MockCache{}
+	jwkCache := &MockJWKCache{}
+	limiter := &MockRateLimiter{allow: true}
+	logger := &MockLogger{}
+
+	verifier := NewVerifier(tokenCache, tokenBlacklist, jwkCache, limiter, logger)
+
+	jwt := &JWT{
+		Header: map[string]interface{}{"alg": "RS256"},
+		Claims: map[string]interface{}{"sub": "user123", "exp": float64(time.Now().Add(time.Hour).Unix())},
+	}
+
+	// Test signature verification (currently returns nil - placeholder)
+	err := verifier.verifyJWTSignatureAndClaims(jwt, "test.token.here", "client-id", "https://example.com/jwks", "https://example.com")
+	if err != nil {
+		t.Errorf("Expected no error from placeholder verification, got: %v", err)
+	}
+}
+
+func TestCacheVerifiedToken(t *testing.T) {
+	tokenCache := &MockTokenCache{}
+	tokenBlacklist := &MockCache{}
+	jwkCache := &MockJWKCache{}
+	limiter := &MockRateLimiter{allow: true}
+	logger := &MockLogger{}
+
+	verifier := NewVerifier(tokenCache, tokenBlacklist, jwkCache, limiter, logger)
+
+	tests := []struct {
+		name     string
+		token    string
+		claims   map[string]interface{}
+		expected bool
+	}{
+		{
+			name:     "Valid expiration time",
+			token:    "test-token-1",
+			claims:   map[string]interface{}{"exp": float64(time.Now().Add(time.Hour).Unix())},
+			expected: true,
+		},
+		{
+			name:     "Expired token",
+			token:    "test-token-2",
+			claims:   map[string]interface{}{"exp": float64(time.Now().Add(-time.Hour).Unix())},
+			expected: false,
+		},
+		{
+			name:     "No expiration claim",
+			token:    "test-token-3",
+			claims:   map[string]interface{}{"sub": "user123"},
+			expected: false,
+		},
+		{
+			name:     "Invalid expiration type",
+			token:    "test-token-4",
+			claims:   map[string]interface{}{"exp": "invalid"},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Clear cache before test
+			tokenCache.data = make(map[string]map[string]interface{})
+
+			verifier.cacheVerifiedToken(tt.token, tt.claims)
+
+			_, exists := tokenCache.Get(tt.token)
+			if exists != tt.expected {
+				t.Errorf("Expected cache existence: %v, got: %v", tt.expected, exists)
+			}
+		})
+	}
+}
+
+func TestMockInterfaces(t *testing.T) {
+	// Test MockTokenCache
+	tokenCache := &MockTokenCache{}
+	claims := map[string]interface{}{"sub": "user123", "exp": 1234567890}
+	tokenCache.Set("test-token", claims, time.Hour)
+
+	retrieved, exists := tokenCache.Get("test-token")
+	if !exists {
+		t.Error("Expected token to exist in cache")
+	}
+
+	if retrieved["sub"] != "user123" {
+		t.Errorf("Expected sub 'user123', got '%v'", retrieved["sub"])
+	}
+
+	// Test MockCache
+	cache := &MockCache{}
+	cache.Set("test-key", "test-value", time.Hour)
+
+	value, exists := cache.Get("test-key")
+	if !exists {
+		t.Error("Expected key to exist in cache")
+	}
+
+	if value != "test-value" {
+		t.Errorf("Expected 'test-value', got '%v'", value)
+	}
+
+	// Test MockRateLimiter
+	limiter := &MockRateLimiter{allow: true}
+	if !limiter.Allow() {
+		t.Error("Expected rate limiter to allow request")
+	}
+
+	limiter.allow = false
+	if limiter.Allow() {
+		t.Error("Expected rate limiter to deny request")
+	}
+
+	// Test MockLogger
+	logger := &MockLogger{}
+	logger.Debugf("test debug message")
+	logger.Errorf("test error message")
+
+	if len(logger.debugMessages) != 1 {
+		t.Errorf("Expected 1 debug message, got %d", len(logger.debugMessages))
+	}
+
+	if len(logger.errorMessages) != 1 {
+		t.Errorf("Expected 1 error message, got %d", len(logger.errorMessages))
+	}
+}

internal/utils/utils_test.go

@@ -1,6 +1,7 @@
 package utils
 
 import (
+	"os"
 	"reflect"
 	"testing"
 )
@@ -128,3 +129,427 @@ func TestBuildFullURL(t *testing.T) {
 		}
 	}
 }
+
+func TestIsTestMode(t *testing.T) {
+	// This test is challenging because IsTestMode() depends on runtime conditions.
+	// We'll test what we can control via environment variables.
+
+	tests := []struct {
+		name     string
+		setup    func()
+		cleanup  func()
+		expected bool
+	}{
+		{
+			name: "suppress diagnostic logs enabled",
+			setup: func() {
+				os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", "1")
+			},
+			cleanup: func() {
+				os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+			},
+			expected: true,
+		},
+		{
+			name: "GO_TEST environment variable set",
+			setup: func() {
+				os.Setenv("GO_TEST", "1")
+			},
+			cleanup: func() {
+				os.Unsetenv("GO_TEST")
+			},
+			expected: true,
+		},
+		{
+			name: "normal runtime conditions",
+			setup: func() {
+				// Disable runtime stack check to test fallback behavior
+				os.Setenv("DISABLE_RUNTIME_STACK_CHECK", "1")
+				os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", "")
+				os.Setenv("GO_TEST", "")
+			},
+			cleanup: func() {
+				os.Unsetenv("DISABLE_RUNTIME_STACK_CHECK")
+				os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+				os.Unsetenv("GO_TEST")
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup test environment
+			tt.setup()
+			defer tt.cleanup()
+
+			result := IsTestMode()
+
+			// Note: Some test conditions may still return true due to runtime.Stack
+			// detecting testing context, so we check the expected behavior when possible
+			if tt.name == "suppress diagnostic logs enabled" || tt.name == "GO_TEST environment variable set" {
+				if result != tt.expected {
+					t.Errorf("Expected %v, got %v", tt.expected, result)
+				}
+			}
+		})
+	}
+
+	// Test that IsTestMode() returns true when called from a test context
+	// (which it should, since we're in a test right now)
+	result := IsTestMode()
+	if !result {
+		t.Log("Note: IsTestMode() returned false in test context, which may be expected depending on runtime conditions")
+	}
+}
+
+func TestIsTestModeEdgeCases(t *testing.T) {
+	// Test with various environment variable combinations
+	tests := []struct {
+		name string
+		env  map[string]string
+	}{
+		{
+			name: "all env vars empty",
+			env: map[string]string{
+				"SUPPRESS_DIAGNOSTIC_LOGS":    "",
+				"GO_TEST":                     "",
+				"DISABLE_RUNTIME_STACK_CHECK": "",
+			},
+		},
+		{
+			name: "mixed env vars",
+			env: map[string]string{
+				"SUPPRESS_DIAGNOSTIC_LOGS":    "0",
+				"GO_TEST":                     "true",
+				"DISABLE_RUNTIME_STACK_CHECK": "1",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Save original environment
+			original := make(map[string]string)
+			for key := range tt.env {
+				original[key] = os.Getenv(key)
+			}
+
+			// Set test environment
+			for key, value := range tt.env {
+				os.Setenv(key, value)
+			}
+
+			// Test IsTestMode (result may vary based on runtime conditions)
+			result := IsTestMode()
+			_ = result // We just want to ensure it doesn't panic
+
+			// Restore original environment
+			for key, value := range original {
+				if value == "" {
+					os.Unsetenv(key)
+				} else {
+					os.Setenv(key, value)
+				}
+			}
+		})
+	}
+}
+
+func TestIsTestModeDetectionMethods(t *testing.T) {
+	// Test that calling IsTestMode in a test context returns true
+	// This should cover most of the function branches since we're in a test
+	result := IsTestMode()
+
+	// In a test context, IsTestMode should return true
+	if !result {
+		t.Log("IsTestMode returned false in test context - this may be due to environment settings")
+	}
+
+	// Test with explicit environment manipulation to force different paths
+	originalSuppressDiag := os.Getenv("SUPPRESS_DIAGNOSTIC_LOGS")
+	originalGoTest := os.Getenv("GO_TEST")
+	originalDisableStack := os.Getenv("DISABLE_RUNTIME_STACK_CHECK")
+
+	defer func() {
+		// Restore original environment
+		if originalSuppressDiag == "" {
+			os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+		} else {
+			os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", originalSuppressDiag)
+		}
+		if originalGoTest == "" {
+			os.Unsetenv("GO_TEST")
+		} else {
+			os.Setenv("GO_TEST", originalGoTest)
+		}
+		if originalDisableStack == "" {
+			os.Unsetenv("DISABLE_RUNTIME_STACK_CHECK")
+		} else {
+			os.Setenv("DISABLE_RUNTIME_STACK_CHECK", originalDisableStack)
+		}
+	}()
+
+	// Test various combinations to exercise different code paths
+	testCases := []struct {
+		name         string
+		suppressDiag string
+		goTest       string
+		disableStack string
+		expectTrue   bool
+	}{
+		{
+			name:         "suppress_diagnostic_logs_1",
+			suppressDiag: "1",
+			goTest:       "",
+			disableStack: "",
+			expectTrue:   true,
+		},
+		{
+			name:         "go_test_1",
+			suppressDiag: "",
+			goTest:       "1",
+			disableStack: "",
+			expectTrue:   true,
+		},
+		{
+			name:         "runtime_detection_allowed",
+			suppressDiag: "",
+			goTest:       "",
+			disableStack: "",
+			expectTrue:   true, // Should detect test context from runtime stack
+		},
+		{
+			name:         "runtime_detection_disabled",
+			suppressDiag: "",
+			goTest:       "",
+			disableStack: "1",
+			expectTrue:   false, // May still be true due to os.Args detection
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", tc.suppressDiag)
+			os.Setenv("GO_TEST", tc.goTest)
+			os.Setenv("DISABLE_RUNTIME_STACK_CHECK", tc.disableStack)
+
+			result := IsTestMode()
+
+			// For environment variable cases, we can assert the expected result
+			if tc.name == "suppress_diagnostic_logs_1" || tc.name == "go_test_1" {
+				if result != tc.expectTrue {
+					t.Errorf("Expected %v, got %v for case %s", tc.expectTrue, result, tc.name)
+				}
+			}
+			// For runtime detection cases, result may vary based on actual runtime conditions
+		})
+	}
+}
+
+func TestUtilsPackageComplete(t *testing.T) {
+	// Test edge cases to improve coverage
+
+	// Test CreateStringMap with empty slice
+	emptyResult := CreateStringMap([]string{})
+	if len(emptyResult) != 0 {
+		t.Errorf("Expected empty map, got %v", emptyResult)
+	}
+
+	// Test CreateCaseInsensitiveStringMap with empty slice
+	emptyInsensitiveResult := CreateCaseInsensitiveStringMap([]string{})
+	if len(emptyInsensitiveResult) != 0 {
+		t.Errorf("Expected empty map, got %v", emptyInsensitiveResult)
+	}
+
+	// Test DeduplicateScopes with empty slice
+	emptyScopes := DeduplicateScopes([]string{})
+	if len(emptyScopes) != 0 {
+		t.Errorf("Expected empty slice, got %v", emptyScopes)
+	}
+
+	// Test MergeScopes with nil slices
+	nilResult := MergeScopes(nil, nil)
+	if len(nilResult) != 0 {
+		t.Errorf("Expected empty slice, got %v", nilResult)
+	}
+
+	// Test KeysFromMap with empty map
+	emptyMapKeys := KeysFromMap(map[string]struct{}{})
+	if len(emptyMapKeys) != 0 {
+		t.Errorf("Expected empty slice, got %v", emptyMapKeys)
+	}
+
+	// Test BuildFullURL with empty values
+	emptyURL := BuildFullURL("", "", "")
+	expected := "://"
+	if emptyURL != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, emptyURL)
+	}
+}
+
+func TestIsTestModeOsArgsDetection(t *testing.T) {
+	// Save original os.Args
+	originalArgs := os.Args
+	defer func() { os.Args = originalArgs }()
+
+	// Test with different os.Args[0] values that should trigger test mode
+	testCases := []struct {
+		name     string
+		args0    string
+		expected bool
+	}{
+		{
+			name:     "Binary with .test suffix",
+			args0:    "/path/to/myapp.test",
+			expected: true,
+		},
+		{
+			name:     "Binary with go_build_ prefix",
+			args0:    "/tmp/go_build_myapp",
+			expected: true,
+		},
+		{
+			name:     "Binary with test in name",
+			args0:    "/path/to/test_binary",
+			expected: true,
+		},
+		{
+			name:     "Binary with __debug_bin",
+			args0:    "/path/to/__debug_bin123",
+			expected: true,
+		},
+		{
+			name:     "Regular binary name",
+			args0:    "/path/to/myapp",
+			expected: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up environment to avoid interference from other detection methods
+			os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", "")
+			os.Setenv("GO_TEST", "")
+			os.Setenv("DISABLE_RUNTIME_STACK_CHECK", "1") // Disable runtime stack check
+			defer func() {
+				os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+				os.Unsetenv("GO_TEST")
+				os.Unsetenv("DISABLE_RUNTIME_STACK_CHECK")
+			}()
+
+			// Set os.Args
+			os.Args = []string{tc.args0}
+
+			result := IsTestMode()
+			if result != tc.expected {
+				t.Errorf("For args[0] = '%s': expected %v, got %v", tc.args0, tc.expected, result)
+			}
+		})
+	}
+}
+
+func TestIsTestModeArgsFlagDetection(t *testing.T) {
+	// Save original os.Args
+	originalArgs := os.Args
+	defer func() { os.Args = originalArgs }()
+
+	testCases := []struct {
+		name     string
+		args     []string
+		expected bool
+	}{
+		{
+			name:     "Args contain -test flag",
+			args:     []string{"/path/to/app", "-test.v", "true"},
+			expected: true,
+		},
+		{
+			name:     "Args contain -test.timeout",
+			args:     []string{"/path/to/app", "-test.timeout", "30s"},
+			expected: true,
+		},
+		{
+			name:     "Args without test flags",
+			args:     []string{"/path/to/app", "-verbose", "-config", "file.conf"},
+			expected: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up environment to avoid interference
+			os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", "")
+			os.Setenv("GO_TEST", "")
+			os.Setenv("DISABLE_RUNTIME_STACK_CHECK", "1")
+			defer func() {
+				os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+				os.Unsetenv("GO_TEST")
+				os.Unsetenv("DISABLE_RUNTIME_STACK_CHECK")
+			}()
+
+			// Ensure args[0] doesn't trigger detection by itself
+			if len(tc.args) > 0 {
+				tc.args[0] = "/regular/app/name"
+			}
+			os.Args = tc.args
+
+			result := IsTestMode()
+			if result != tc.expected {
+				t.Errorf("For args = %v: expected %v, got %v", tc.args, tc.expected, result)
+			}
+		})
+	}
+}
+
+func TestIsTestModeRuntimeCompiler(t *testing.T) {
+	// This test verifies that the runtime.Compiler check works
+	// We can't easily change runtime.Compiler, but we can test the logic path
+
+	// Set up environment to isolate this test
+	originalArgs := os.Args
+	defer func() { os.Args = originalArgs }()
+
+	os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", "")
+	os.Setenv("GO_TEST", "")
+	os.Setenv("DISABLE_RUNTIME_STACK_CHECK", "1")
+	defer func() {
+		os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+		os.Unsetenv("GO_TEST")
+		os.Unsetenv("DISABLE_RUNTIME_STACK_CHECK")
+	}()
+
+	// Test with args that should trigger test mode when runtime.Compiler == "gc"
+	os.Args = []string{"some_test_binary", "arg1"}
+
+	result := IsTestMode()
+	// Since runtime.Compiler is "gc" in most cases and os.Args[0] contains "test",
+	// this should return true
+	if !result {
+		t.Log("Note: This test may vary depending on the actual runtime.Compiler value")
+	}
+}
+
+func TestIsTestModeYaegiCompiler(t *testing.T) {
+	// Test the yaegi compiler detection
+	// We can't change runtime.Compiler directly, but we can verify the GO_TEST path
+
+	originalArgs := os.Args
+	defer func() { os.Args = originalArgs }()
+
+	// Test that GO_TEST=1 triggers test mode regardless of other conditions
+	os.Setenv("GO_TEST", "1")
+	os.Setenv("SUPPRESS_DIAGNOSTIC_LOGS", "")
+	defer func() {
+		os.Unsetenv("GO_TEST")
+		os.Unsetenv("SUPPRESS_DIAGNOSTIC_LOGS")
+	}()
+
+	// Use a non-test-like binary name
+	os.Args = []string{"/regular/binary/name"}
+
+	result := IsTestMode()
+	if !result {
+		t.Error("Expected true when GO_TEST=1 is set")
+	}
+}

jwt.go

@@ -1,19 +1,21 @@
 package traefikoidc
 
 import (
+	"bytes"
 	"context"
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/base64"
-	"encoding/json"
 	"encoding/pem"
 	"fmt"
 	"math/big"
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/pool"
 )
 
 // Replay attack protection cache and synchronization primitives.
@@ -173,28 +175,30 @@ func parseJWT(tokenString string) (*JWT, error) {
 		return nil, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts))
 	}
 
-	pools := GetGlobalMemoryPools()
-	jwtBuf := pools.GetJWTParsingBuffer()
-	defer pools.PutJWTParsingBuffer(jwtBuf)
+	pm := pool.Get()
+	jwtBuf := pm.GetJWTBuffer()
+	defer pm.PutJWTBuffer(jwtBuf)
 
 	jwt := &JWT{
 		Token: tokenString,
 	}
 
 	headerLen := base64.RawURLEncoding.DecodedLen(len(parts[0]))
-	if headerLen > cap(jwtBuf.HeaderBuf) {
-		jwtBuf.HeaderBuf = make([]byte, headerLen)
+	if headerLen > cap(jwtBuf.Header) {
+		jwtBuf.Header = make([]byte, headerLen)
 	} else {
-		jwtBuf.HeaderBuf = jwtBuf.HeaderBuf[:headerLen]
+		jwtBuf.Header = jwtBuf.Header[:headerLen]
 	}
 
-	n, err := base64.RawURLEncoding.Decode(jwtBuf.HeaderBuf, []byte(parts[0]))
+	n, err := base64.RawURLEncoding.Decode(jwtBuf.Header, []byte(parts[0]))
 	if err != nil {
 		return nil, fmt.Errorf("invalid JWT format: failed to decode header: %v", err)
 	}
-	headerBytes := jwtBuf.HeaderBuf[:n]
+	headerBytes := jwtBuf.Header[:n]
 
-	if err := json.Unmarshal(headerBytes, &jwt.Header); err != nil {
+	decoder := pm.GetJSONDecoder(bytes.NewReader(headerBytes))
+	defer pm.PutJSONDecoder(decoder)
+	if err := decoder.Decode(&jwt.Header); err != nil {
 		return nil, fmt.Errorf("invalid JWT format: failed to unmarshal header: %v", err)
 	}
 
@@ -203,19 +207,21 @@ func parseJWT(tokenString string) (*JWT, error) {
 	}
 
 	claimsLen := base64.RawURLEncoding.DecodedLen(len(parts[1]))
-	if claimsLen > cap(jwtBuf.PayloadBuf) {
-		jwtBuf.PayloadBuf = make([]byte, claimsLen)
+	if claimsLen > cap(jwtBuf.Payload) {
+		jwtBuf.Payload = make([]byte, claimsLen)
 	} else {
-		jwtBuf.PayloadBuf = jwtBuf.PayloadBuf[:claimsLen]
+		jwtBuf.Payload = jwtBuf.Payload[:claimsLen]
 	}
 
-	n, err = base64.RawURLEncoding.Decode(jwtBuf.PayloadBuf, []byte(parts[1]))
+	n, err = base64.RawURLEncoding.Decode(jwtBuf.Payload, []byte(parts[1]))
 	if err != nil {
 		return nil, fmt.Errorf("invalid JWT format: failed to decode claims: %v", err)
 	}
-	claimsBytes := jwtBuf.PayloadBuf[:n]
+	claimsBytes := jwtBuf.Payload[:n]
 
-	if err := json.Unmarshal(claimsBytes, &jwt.Claims); err != nil {
+	decoder2 := pm.GetJSONDecoder(bytes.NewReader(claimsBytes))
+	defer pm.PutJSONDecoder(decoder2)
+	if err := decoder2.Decode(&jwt.Claims); err != nil {
 		return nil, fmt.Errorf("invalid JWT format: failed to unmarshal claims: %v", err)
 	}
 
@@ -224,19 +230,24 @@ func parseJWT(tokenString string) (*JWT, error) {
 	}
 
 	sigLen := base64.RawURLEncoding.DecodedLen(len(parts[2]))
-	if sigLen > cap(jwtBuf.SignatureBuf) {
-		jwtBuf.SignatureBuf = make([]byte, sigLen)
+	if sigLen > cap(jwtBuf.Signature) {
+		jwtBuf.Signature = make([]byte, sigLen)
 	} else {
-		jwtBuf.SignatureBuf = jwtBuf.SignatureBuf[:sigLen]
+		jwtBuf.Signature = jwtBuf.Signature[:sigLen]
 	}
 
-	n, err = base64.RawURLEncoding.Decode(jwtBuf.SignatureBuf, []byte(parts[2]))
+	n, err = base64.RawURLEncoding.Decode(jwtBuf.Signature, []byte(parts[2]))
 	if err != nil {
 		return nil, fmt.Errorf("invalid JWT format: failed to decode signature: %v", err)
 	}
 
-	jwt.Signature = make([]byte, n)
-	copy(jwt.Signature, jwtBuf.SignatureBuf[:n])
+	// Reuse the signature buffer if it's large enough, otherwise allocate
+	if cap(jwtBuf.Signature) >= n {
+		jwt.Signature = jwtBuf.Signature[:n:n] // Use slice trick to prevent aliasing
+	} else {
+		jwt.Signature = make([]byte, n)
+		copy(jwt.Signature, jwtBuf.Signature[:n])
+	}
 
 	return jwt, nil
 }

memory_pools.go

@@ -1,264 +0,0 @@
-package traefikoidc
-
-import (
-	"bytes"
-	"strings"
-	"sync"
-)
-
-// MemoryPoolManager provides centralized management of object pools for memory efficiency.
-// It maintains pools for frequently allocated objects like buffers for compression, JWT parsing,
-// HTTP responses, and string building operations to reduce garbage collection pressure.
-type MemoryPoolManager struct {
-	// compressionBufferPool pools buffers for compression/decompression operations
-	compressionBufferPool *sync.Pool
-	// jwtParsingPool pools specialized buffers for JWT token parsing
-	jwtParsingPool *sync.Pool
-	// httpResponsePool pools buffers for HTTP response handling
-	httpResponsePool *sync.Pool
-	// stringBuilderPool pools string.Builder instances for string operations
-	stringBuilderPool *sync.Pool
-}
-
-// JWTParsingBuffer provides pre-allocated buffers for JWT token parsing.
-// Using pooled buffers for the three JWT components (header, payload, signature)
-// avoids repeated allocations during token validation, which can significantly
-// improve performance under high load.
-type JWTParsingBuffer struct {
-	// HeaderBuf stores the decoded JWT header
-	HeaderBuf []byte
-	// PayloadBuf stores the decoded JWT payload/claims
-	PayloadBuf []byte
-	// SignatureBuf stores the decoded JWT signature
-	SignatureBuf []byte
-}
-
-// NewMemoryPoolManager creates a new memory pool manager with optimized pool configurations.
-// Each pool is initialized with appropriate buffer sizes to balance memory usage with performance benefits.
-func NewMemoryPoolManager() *MemoryPoolManager {
-	return &MemoryPoolManager{
-		compressionBufferPool: &sync.Pool{
-			New: func() interface{} {
-				return bytes.NewBuffer(make([]byte, 0, 4096))
-			},
-		},
-
-		jwtParsingPool: &sync.Pool{
-			New: func() interface{} {
-				return &JWTParsingBuffer{
-					HeaderBuf:    make([]byte, 0, 512),
-					PayloadBuf:   make([]byte, 0, 2048),
-					SignatureBuf: make([]byte, 0, 512),
-				}
-			},
-		},
-
-		httpResponsePool: &sync.Pool{
-			New: func() interface{} {
-				buf := make([]byte, 0, 8192)
-				return &buf
-			},
-		},
-
-		stringBuilderPool: &sync.Pool{
-			New: func() interface{} {
-				var sb strings.Builder
-				sb.Grow(1024)
-				return &sb
-			},
-		},
-	}
-}
-
-// GetCompressionBuffer retrieves a buffer from the compression pool.
-// The buffer should be returned to the pool using PutCompressionBuffer when done.
-func (m *MemoryPoolManager) GetCompressionBuffer() *bytes.Buffer {
-	return m.compressionBufferPool.Get().(*bytes.Buffer)
-}
-
-// PutCompressionBuffer returns a compression buffer to the pool.
-// The buffer is reset before being returned to prevent data leaks.
-// Oversized buffers are discarded to prevent memory bloat.
-func (m *MemoryPoolManager) PutCompressionBuffer(buf *bytes.Buffer) {
-	if buf == nil {
-		return
-	}
-
-	if buf.Cap() <= 16384 {
-		buf.Reset()
-		m.compressionBufferPool.Put(buf)
-	}
-}
-
-// GetJWTParsingBuffer retrieves specialized buffers for JWT parsing.
-// Returns a structure with pre-allocated buffers for header, payload, and signature.
-func (m *MemoryPoolManager) GetJWTParsingBuffer() *JWTParsingBuffer {
-	return m.jwtParsingPool.Get().(*JWTParsingBuffer)
-}
-
-// PutJWTParsingBuffer returns JWT parsing buffers to the pool.
-// All buffer slices are reset to zero length and oversized buffers are discarded.
-func (m *MemoryPoolManager) PutJWTParsingBuffer(buf *JWTParsingBuffer) {
-	if buf == nil {
-		return
-	}
-
-	if cap(buf.HeaderBuf) <= 2048 && cap(buf.PayloadBuf) <= 8192 && cap(buf.SignatureBuf) <= 2048 {
-		buf.HeaderBuf = buf.HeaderBuf[:0]
-		buf.PayloadBuf = buf.PayloadBuf[:0]
-		buf.SignatureBuf = buf.SignatureBuf[:0]
-		m.jwtParsingPool.Put(buf)
-	}
-}
-
-// GetHTTPResponseBuffer retrieves a buffer for HTTP response handling.
-// Returns a pre-allocated byte slice suitable for HTTP operations.
-func (m *MemoryPoolManager) GetHTTPResponseBuffer() []byte {
-	return *m.httpResponsePool.Get().(*[]byte)
-}
-
-// PutHTTPResponseBuffer returns an HTTP response buffer to the pool.
-// The buffer slice is reset to zero length and oversized buffers are discarded.
-func (m *MemoryPoolManager) PutHTTPResponseBuffer(buf []byte) {
-	if buf == nil {
-		return
-	}
-
-	if cap(buf) <= 32768 {
-		buf = buf[:0]
-		m.httpResponsePool.Put(&buf)
-	}
-}
-
-// GetStringBuilder retrieves a pre-allocated string builder from the pool.
-// The string builder is ready for use with an initial capacity allocation.
-func (m *MemoryPoolManager) GetStringBuilder() *strings.Builder {
-	return m.stringBuilderPool.Get().(*strings.Builder)
-}
-
-// PutStringBuilder returns a string builder to the pool.
-// The builder is reset and oversized builders are discarded to prevent memory bloat.
-func (m *MemoryPoolManager) PutStringBuilder(sb *strings.Builder) {
-	if sb == nil {
-		return
-	}
-
-	if sb.Cap() <= 16384 {
-		sb.Reset()
-		m.stringBuilderPool.Put(sb)
-	}
-}
-
-// TokenCompressionPool manages specialized memory pools for token compression operations.
-// Provides separate pools optimized for compression, decompression, and string building
-// to handle the specific memory patterns of token processing workflows.
-type TokenCompressionPool struct {
-	// compressionBuffers pools buffers specifically sized for token compression
-	compressionBuffers sync.Pool
-	// decompressionBuffers pools buffers for token decompression with larger capacity
-	decompressionBuffers sync.Pool
-	// stringBuilders pools string builders optimized for token operations
-	stringBuilders sync.Pool
-}
-
-// NewTokenCompressionPool creates a specialized memory pool for token operations.
-// Initializes pools with buffer sizes optimized for token compression workflows.
-func NewTokenCompressionPool() *TokenCompressionPool {
-	return &TokenCompressionPool{
-		compressionBuffers: sync.Pool{
-			New: func() interface{} {
-				return bytes.NewBuffer(make([]byte, 0, 4096))
-			},
-		},
-		decompressionBuffers: sync.Pool{
-			New: func() interface{} {
-				return bytes.NewBuffer(make([]byte, 0, 8192))
-			},
-		},
-		stringBuilders: sync.Pool{
-			New: func() interface{} {
-				var sb strings.Builder
-				sb.Grow(2048)
-				return &sb
-			},
-		},
-	}
-}
-
-// GetCompressionBuffer retrieves a buffer optimized for token compression.
-// Returns a buffer with appropriate capacity for typical token sizes.
-func (p *TokenCompressionPool) GetCompressionBuffer() *bytes.Buffer {
-	return p.compressionBuffers.Get().(*bytes.Buffer)
-}
-
-// PutCompressionBuffer returns a compression buffer to the pool.
-// Resets the buffer and discards oversized buffers to prevent memory bloat.
-func (p *TokenCompressionPool) PutCompressionBuffer(buf *bytes.Buffer) {
-	if buf != nil && buf.Cap() <= 16384 {
-		buf.Reset()
-		p.compressionBuffers.Put(buf)
-	}
-}
-
-// GetDecompressionBuffer retrieves a buffer optimized for token decompression.
-// Returns a larger buffer suitable for expanded token data.
-func (p *TokenCompressionPool) GetDecompressionBuffer() *bytes.Buffer {
-	return p.decompressionBuffers.Get().(*bytes.Buffer)
-}
-
-// PutDecompressionBuffer returns a decompression buffer to the pool.
-// Resets the buffer and discards oversized buffers to prevent memory bloat.
-func (p *TokenCompressionPool) PutDecompressionBuffer(buf *bytes.Buffer) {
-	if buf != nil && buf.Cap() <= 32768 {
-		buf.Reset()
-		p.decompressionBuffers.Put(buf)
-	}
-}
-
-// GetStringBuilder retrieves a string builder optimized for token operations.
-// Returns a pre-allocated builder with capacity suitable for token processing.
-func (p *TokenCompressionPool) GetStringBuilder() *strings.Builder {
-	return p.stringBuilders.Get().(*strings.Builder)
-}
-
-// PutStringBuilder returns a string builder to the pool.
-// Resets the builder and discards oversized builders to prevent memory bloat.
-func (p *TokenCompressionPool) PutStringBuilder(sb *strings.Builder) {
-	if sb != nil && sb.Cap() <= 16384 {
-		sb.Reset()
-		p.stringBuilders.Put(sb)
-	}
-}
-
-// Global memory pool manager instance and synchronization primitives.
-// Provides singleton access to memory pools across the entire application.
-var (
-	// globalMemoryPools is the singleton memory pool manager instance
-	globalMemoryPools *MemoryPoolManager
-	// memoryPoolOnce ensures single initialization of the global pools
-	memoryPoolOnce sync.Once
-	// memoryPoolMutex protects global pool operations
-	memoryPoolMutex sync.RWMutex
-)
-
-// GetGlobalMemoryPools returns the singleton memory pool manager instance.
-// Uses sync.Once to ensure thread-safe initialization of the global pools.
-func GetGlobalMemoryPools() *MemoryPoolManager {
-	memoryPoolOnce.Do(func() {
-		globalMemoryPools = NewMemoryPoolManager()
-	})
-	return globalMemoryPools
-}
-
-// CleanupGlobalMemoryPools cleans up the global memory pool manager.
-// Resets the singleton instance and sync.Once for potential re-initialization.
-// It's safe to call multiple times.
-func CleanupGlobalMemoryPools() {
-	memoryPoolMutex.Lock()
-	defer memoryPoolMutex.Unlock()
-
-	if globalMemoryPools != nil {
-		globalMemoryPools = nil
-		memoryPoolOnce = sync.Once{}
-	}
-}

middleware.go

@@ -0,0 +1,371 @@
+// Package traefikoidc provides OIDC authentication middleware for Traefik.
+// This file contains the core HTTP middleware functionality for request processing
+// and authentication flow management.
+package traefikoidc
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// ============================================================================
+// HTTP MIDDLEWARE
+// ============================================================================
+
+// ServeHTTP implements the main middleware logic for processing HTTP requests.
+// It handles the complete OIDC authentication flow including:
+//   - Excluded URL bypass
+//   - Session validation and management
+//   - Authentication callback processing
+//   - Logout handling
+//   - Token verification and refresh
+//   - Header injection for authenticated requests
+//
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The incoming HTTP request.
+func (t *TraefikOidc) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	if !strings.HasPrefix(req.URL.Path, "/health") {
+		t.firstRequestMutex.Lock()
+		if !t.firstRequestReceived {
+			t.firstRequestReceived = true
+			t.logger.Debug("Starting background tasks on first request")
+			t.startTokenCleanup()
+
+			if !t.metadataRefreshStarted && t.providerURL != "" {
+				t.metadataRefreshStarted = true
+				// Metadata refresh is handled by singleton resource manager
+				t.startMetadataRefresh(t.providerURL)
+			}
+		}
+		t.firstRequestMutex.Unlock()
+	}
+
+	select {
+	case <-t.initComplete:
+		if t.issuerURL == "" {
+			t.logger.Error("OIDC provider metadata initialization failed or incomplete")
+			t.sendErrorResponse(rw, req, "OIDC provider metadata initialization failed - please check provider availability and configuration", http.StatusServiceUnavailable)
+			return
+		}
+	case <-req.Context().Done():
+		t.logger.Debug("Request cancelled while waiting for OIDC initialization")
+		t.sendErrorResponse(rw, req, "Request cancelled", http.StatusRequestTimeout)
+		return
+	case <-time.After(30 * time.Second):
+		t.logger.Error("Timeout waiting for OIDC initialization")
+		t.sendErrorResponse(rw, req, "Timeout waiting for OIDC provider initialization - please try again later", http.StatusServiceUnavailable)
+		return
+	}
+
+	if t.determineExcludedURL(req.URL.Path) {
+		t.logger.Debugf("Request path %s excluded by configuration, bypassing OIDC", req.URL.Path)
+		t.next.ServeHTTP(rw, req)
+		return
+	}
+	acceptHeader := req.Header.Get("Accept")
+	if strings.Contains(acceptHeader, "text/event-stream") {
+		t.logger.Debugf("Request accepts text/event-stream (%s), bypassing OIDC", acceptHeader)
+		t.next.ServeHTTP(rw, req)
+		return
+	}
+
+	t.sessionManager.CleanupOldCookies(rw, req)
+
+	session, err := t.sessionManager.GetSession(req)
+	if err != nil {
+		t.logger.Errorf("Error getting session: %v. Initiating authentication.", err)
+		cleanReq := req.Clone(req.Context())
+		session, _ = t.sessionManager.GetSession(cleanReq)
+		if session != nil {
+			defer session.returnToPoolSafely()
+			if clearErr := session.Clear(cleanReq, rw); clearErr != nil {
+				t.logger.Errorf("Error clearing potentially corrupted session: %v", clearErr)
+			}
+		} else {
+			t.logger.Error("Critical session error: Failed to get even a new session.")
+			t.sendErrorResponse(rw, req, "Critical session error", http.StatusInternalServerError)
+			return
+		}
+		scheme := t.determineScheme(req)
+		host := t.determineHost(req)
+		redirectURL := buildFullURL(scheme, host, t.redirURLPath)
+		t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+		return
+	}
+
+	defer session.returnToPoolSafely()
+
+	scheme := t.determineScheme(req)
+	host := t.determineHost(req)
+	redirectURL := buildFullURL(scheme, host, t.redirURLPath)
+
+	if req.URL.Path == t.logoutURLPath {
+		t.handleLogout(rw, req)
+		return
+	}
+	if req.URL.Path == t.redirURLPath {
+		t.handleCallback(rw, req, redirectURL)
+		return
+	}
+
+	authenticated, needsRefresh, expired := t.isUserAuthenticated(session)
+
+	if expired {
+		t.logger.Debug("Session token is definitively expired or invalid, initiating re-auth")
+		t.handleExpiredToken(rw, req, session, redirectURL)
+		return
+	}
+
+	email := session.GetEmail()
+	// Domain restriction check removed debug output
+	if authenticated && email != "" {
+		if !t.isAllowedDomain(email) {
+			t.logger.Infof("User with email %s is not from an allowed domain", email)
+			errorMsg := fmt.Sprintf("Access denied: Your email domain is not allowed. To log out, visit: %s", t.logoutURLPath)
+			t.sendErrorResponse(rw, req, errorMsg, http.StatusForbidden)
+			return
+		}
+	}
+
+	if authenticated && !needsRefresh {
+		t.logger.Debug("User authenticated and token valid, proceeding to process authorized request")
+		if accessToken := session.GetAccessToken(); accessToken != "" {
+			if strings.Count(accessToken, ".") == 2 {
+				if err := t.verifyToken(accessToken); err != nil {
+					t.logger.Errorf("Access token validation failed: %v", err)
+					t.handleExpiredToken(rw, req, session, redirectURL)
+					return
+				}
+			} else {
+				t.logger.Debugf("Access token appears opaque, skipping JWT verification for it.")
+			}
+		}
+		t.processAuthorizedRequest(rw, req, session, redirectURL)
+		return
+	}
+
+	refreshTokenPresent := session.GetRefreshToken() != ""
+
+	// Check if this is an AJAX request that should receive 401 instead of redirect
+	isAjaxRequest := t.isAjaxRequest(req)
+
+	// Check if refresh token is likely expired (older than 6 hours)
+	refreshTokenExpired := refreshTokenPresent && t.isRefreshTokenExpired(session)
+
+	shouldAttemptRefresh := needsRefresh && refreshTokenPresent && !refreshTokenExpired
+
+	// If AJAX request and refresh token expired, return 401 immediately
+	if isAjaxRequest && refreshTokenExpired {
+		t.logger.Debug("AJAX request with expired refresh token, returning 401")
+		t.sendErrorResponse(rw, req, "Session expired", http.StatusUnauthorized)
+		return
+	}
+
+	if shouldAttemptRefresh {
+		idToken := session.GetIDToken()
+		if idToken != "" {
+			jwt, err := parseJWT(idToken)
+			if err == nil {
+				claims := jwt.Claims
+				if expClaim, ok := claims["exp"].(float64); ok {
+					expTime := int64(expClaim)
+					expTimeObj := time.Unix(expTime, 0)
+					refreshThreshold := time.Now().Add(t.refreshGracePeriod)
+
+					if !expTimeObj.Before(refreshThreshold) {
+						t.logger.Debug("Token is valid and outside grace period, skipping refresh")
+						t.processAuthorizedRequest(rw, req, session, redirectURL)
+						return
+					}
+				} else {
+					t.logger.Debug("Could not extract 'exp' claim for grace period check, proceeding with refresh")
+				}
+			}
+		}
+
+		if needsRefresh && authenticated {
+			t.logger.Debug("Session token needs proactive refresh, attempting refresh")
+		} else if needsRefresh && !authenticated {
+			t.logger.Debug("ID token invalid/expired, but refresh token found. Attempting refresh.")
+		}
+
+		refreshed := t.refreshToken(rw, req, session)
+		if refreshed {
+			email = session.GetEmail()
+			if email != "" && !t.isAllowedDomain(email) {
+				t.logger.Infof("User with refreshed token email %s is not from an allowed domain", email)
+				errorMsg := fmt.Sprintf("Access denied: Your email domain is not allowed. To log out, visit: %s", t.logoutURLPath)
+				t.sendErrorResponse(rw, req, errorMsg, http.StatusForbidden)
+				return
+			}
+
+			t.logger.Debug("Token refresh successful, proceeding to process authorized request")
+			t.processAuthorizedRequest(rw, req, session, redirectURL)
+			return
+		}
+
+		t.logger.Debug("Token refresh failed, requiring re-authentication")
+		if isAjaxRequest {
+			t.logger.Debug("AJAX request with failed token refresh, sending 401 Unauthorized")
+			t.sendErrorResponse(rw, req, "Token refresh failed", http.StatusUnauthorized)
+		} else {
+			t.logger.Debug("Browser request with failed token refresh, initiating re-auth")
+			// Reset redirect count when starting fresh auth after failed refresh to prevent redirect loops
+			session.ResetRedirectCount()
+			t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+		}
+		return
+	}
+
+	t.logger.Debugf("Initiating full OIDC authentication flow (authenticated=%v, needsRefresh=%v, refreshTokenPresent=%v)", authenticated, needsRefresh, refreshTokenPresent)
+
+	// If AJAX request without valid authentication, return 401
+	if isAjaxRequest {
+		t.logger.Debug("AJAX request requires authentication, sending 401 Unauthorized")
+		t.sendErrorResponse(rw, req, "Authentication required", http.StatusUnauthorized)
+		return
+	}
+
+	// Reset redirect count when starting fresh authentication flow
+	session.ResetRedirectCount()
+	t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+}
+
+// ============================================================================
+// REQUEST PROCESSING
+// ============================================================================
+
+// processAuthorizedRequest processes requests for authenticated users.
+// It extracts claims, validates roles/groups if configured, sets authentication headers,
+// processes header templates, and forwards the request to the next handler.
+// Domain checks should be performed before calling this method.
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The HTTP request to process.
+//   - session: The user's session data containing tokens and claims.
+//   - redirectURL: The callback URL for re-authentication if needed.
+func (t *TraefikOidc) processAuthorizedRequest(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) {
+	email := session.GetEmail()
+	if email == "" {
+		t.logger.Info("No email found in session during final processing, initiating re-auth")
+		// Reset redirect count to prevent loops when session is invalid
+		session.ResetRedirectCount()
+		t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+		return
+	}
+
+	tokenForClaims := session.GetIDToken()
+	if tokenForClaims == "" {
+		tokenForClaims = session.GetAccessToken()
+		if tokenForClaims == "" && len(t.allowedRolesAndGroups) > 0 {
+			t.logger.Error("No token available but roles/groups checks are required")
+			// Reset redirect count to prevent loops when token is missing
+			session.ResetRedirectCount()
+			t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+			return
+		}
+	}
+
+	// Initialize empty slices
+	var groups, roles []string
+
+	if tokenForClaims != "" {
+		var err error
+		groups, roles, err = t.extractGroupsAndRoles(tokenForClaims)
+		if err != nil && len(t.allowedRolesAndGroups) > 0 {
+			t.logger.Errorf("Failed to extract groups and roles: %v", err)
+			// Reset redirect count to prevent loops when claim extraction fails
+			session.ResetRedirectCount()
+			t.defaultInitiateAuthentication(rw, req, session, redirectURL)
+			return
+		} else if err == nil {
+			if len(groups) > 0 {
+				req.Header.Set("X-User-Groups", strings.Join(groups, ","))
+			}
+			if len(roles) > 0 {
+				req.Header.Set("X-User-Roles", strings.Join(roles, ","))
+			}
+		}
+	}
+
+	if len(t.allowedRolesAndGroups) > 0 {
+		allowed := false
+		for _, roleOrGroup := range append(groups, roles...) {
+			if _, ok := t.allowedRolesAndGroups[roleOrGroup]; ok {
+				allowed = true
+				break
+			}
+		}
+		if !allowed {
+			t.logger.Infof("User with email %s does not have any allowed roles or groups", email)
+			errorMsg := fmt.Sprintf("Access denied: You do not have any of the allowed roles or groups. To log out, visit: %s", t.logoutURLPath)
+			t.sendErrorResponse(rw, req, errorMsg, http.StatusForbidden)
+			return
+		}
+	}
+
+	req.Header.Set("X-Forwarded-User", email)
+
+	req.Header.Set("X-Auth-Request-Redirect", req.URL.RequestURI())
+	req.Header.Set("X-Auth-Request-User", email)
+	if idToken := session.GetIDToken(); idToken != "" {
+		req.Header.Set("X-Auth-Request-Token", idToken)
+	}
+
+	if len(t.headerTemplates) > 0 {
+		claims, err := t.extractClaimsFunc(session.GetIDToken())
+		if err != nil {
+			t.logger.Errorf("Failed to extract claims from ID Token for template headers: %v", err)
+		} else {
+			templateData := map[string]interface{}{
+				"AccessToken":  session.GetAccessToken(),
+				"IDToken":      session.GetIDToken(),
+				"RefreshToken": session.GetRefreshToken(),
+				"Claims":       claims,
+			}
+
+			for headerName, tmpl := range t.headerTemplates {
+				var buf bytes.Buffer
+
+				if err := tmpl.Execute(&buf, templateData); err != nil {
+					t.logger.Errorf("Failed to execute template for header %s: %v", headerName, err)
+					continue
+				}
+				headerValue := buf.String()
+
+				req.Header.Set(headerName, headerValue)
+
+				t.logger.Debugf("Set templated header %s = %s", headerName, headerValue)
+			}
+			session.MarkDirty()
+			t.logger.Debugf("Session marked dirty after templated header processing.")
+		}
+	}
+
+	if session.IsDirty() {
+		if err := session.Save(req, rw); err != nil {
+			t.logger.Errorf("Failed to save session after processing headers: %v", err)
+		}
+	} else {
+		t.logger.Debug("Session not dirty, skipping save in processAuthorizedRequest")
+	}
+
+	// Apply security headers if configured
+	if t.securityHeadersApplier != nil {
+		t.securityHeadersApplier(rw, req)
+	} else {
+		// Fallback to basic security headers
+		rw.Header().Set("X-Frame-Options", "DENY")
+		rw.Header().Set("X-Content-Type-Options", "nosniff")
+		rw.Header().Set("X-XSS-Protection", "1; mode=block")
+		rw.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+	}
+
+	t.logger.Debugf("Request authorized for user %s, forwarding to next handler", email)
+
+	t.next.ServeHTTP(rw, req)
+}

profiling.go

@@ -89,7 +89,7 @@ type LeakDetectionConfig struct {
 	CacheMemoryThreshold uint64
 	// HTTPClientThreshold sets limit for HTTP client connections
 	HTTPClientThreshold int
-	// TokenCompressionThreshold sets limit for token compression memory
+	// Deprecated: TokenCompressionThreshold is no longer used
 	TokenCompressionThreshold uint64
 }
 
@@ -658,157 +658,9 @@ func (hcp *HTTPClientProfiler) AnalyzeLeaks(baseline, current *MemorySnapshot) *
 	return analysis
 }
 
-// TokenCompressionProfiler monitors token compression memory usage
-type TokenCompressionProfiler struct {
-	compressionPool *TokenCompressionPool
-	logger          *Logger
-}
-
-// NewTokenCompressionProfiler creates a new token compression profiler
-func NewTokenCompressionProfiler(pool *TokenCompressionPool, logger *Logger) *TokenCompressionProfiler {
-	if logger == nil {
-		logger = GetSingletonNoOpLogger()
-	}
-	return &TokenCompressionProfiler{
-		compressionPool: pool,
-		logger:          logger,
-	}
-}
-
-// TakeSnapshot captures token compression memory statistics
-func (tcp *TokenCompressionProfiler) TakeSnapshot() (*MemorySnapshot, error) {
-	snapshot := &MemorySnapshot{
-		Timestamp:     time.Now(),
-		CustomMetrics: make(map[string]interface{}),
-	}
-
-	runtime.ReadMemStats(&snapshot.RuntimeStats)
-
-	snapshot.CustomMetrics["compression_pool_active"] = true
-
-	return snapshot, nil
-}
-
-// StartProfiling begins profiling (no-op for compression)
-func (tcp *TokenCompressionProfiler) StartProfiling(config ProfilingConfig) error {
-	return nil
-}
-
-// StopProfiling ends profiling
-func (tcp *TokenCompressionProfiler) StopProfiling() (*MemorySnapshot, error) {
-	return tcp.TakeSnapshot()
-}
-
-// GetCurrentStats returns current memory statistics
-func (tcp *TokenCompressionProfiler) GetCurrentStats() *runtime.MemStats {
-	stats := &runtime.MemStats{}
-	runtime.ReadMemStats(stats)
-	return stats
-}
-
-// AnalyzeLeaks analyzes token compression for memory leaks
-func (tcp *TokenCompressionProfiler) AnalyzeLeaks(baseline, current *MemorySnapshot) *LeakAnalysis {
-	analysis := &LeakAnalysis{
-		SuspectedLeaks:  make([]string, 0),
-		Recommendations: make([]string, 0),
-	}
-
-	if baseline == nil || current == nil {
-		analysis.LeakDescription = "Insufficient compression data"
-		return analysis
-	}
-
-	memoryIncrease := current.RuntimeStats.Alloc - baseline.RuntimeStats.Alloc
-	if memoryIncrease > 2*1024*1024 {
-		analysis.HasLeak = true
-		analysis.SuspectedLeaks = append(analysis.SuspectedLeaks,
-			"Token compression memory usage increased significantly")
-		analysis.Recommendations = append(analysis.Recommendations,
-			"Check for compression buffers not being returned to pool")
-	}
-
-	return analysis
-}
-
-// MemoryPoolProfiler monitors memory pool usage and detects leaks
-type MemoryPoolProfiler struct {
-	memoryPoolManager    *MemoryPoolManager
-	tokenCompressionPool *TokenCompressionPool
-	logger               *Logger
-}
-
-// NewMemoryPoolProfiler creates a new memory pool profiler
-func NewMemoryPoolProfiler(memoryPoolManager *MemoryPoolManager, tokenCompressionPool *TokenCompressionPool, logger *Logger) *MemoryPoolProfiler {
-	if logger == nil {
-		logger = GetSingletonNoOpLogger()
-	}
-	return &MemoryPoolProfiler{
-		memoryPoolManager:    memoryPoolManager,
-		tokenCompressionPool: tokenCompressionPool,
-		logger:               logger,
-	}
-}
-
-// TakeSnapshot captures memory pool statistics
-func (mpp *MemoryPoolProfiler) TakeSnapshot() (*MemorySnapshot, error) {
-	snapshot := &MemorySnapshot{
-		Timestamp:     time.Now(),
-		CustomMetrics: make(map[string]interface{}),
-	}
-
-	runtime.ReadMemStats(&snapshot.RuntimeStats)
-
-	if mpp.memoryPoolManager != nil {
-		snapshot.CustomMetrics["memory_pool_active"] = true
-	}
-
-	if mpp.tokenCompressionPool != nil {
-		snapshot.CustomMetrics["token_compression_pool_active"] = true
-	}
-
-	return snapshot, nil
-}
-
-// StartProfiling begins profiling (no-op for memory pools)
-func (mpp *MemoryPoolProfiler) StartProfiling(config ProfilingConfig) error {
-	return nil
-}
-
-// StopProfiling ends profiling
-func (mpp *MemoryPoolProfiler) StopProfiling() (*MemorySnapshot, error) {
-	return mpp.TakeSnapshot()
-}
-
-// GetCurrentStats returns current memory statistics
-func (mpp *MemoryPoolProfiler) GetCurrentStats() *runtime.MemStats {
-	stats := &runtime.MemStats{}
-	runtime.ReadMemStats(stats)
-	return stats
-}
-
-// AnalyzeLeaks analyzes memory pools for leaks
-func (mpp *MemoryPoolProfiler) AnalyzeLeaks(baseline, current *MemorySnapshot) *LeakAnalysis {
-	analysis := &LeakAnalysis{
-		SuspectedLeaks:  make([]string, 0),
-		Recommendations: make([]string, 0),
-	}
-
-	if baseline == nil || current == nil {
-		analysis.LeakDescription = "Insufficient memory pool data"
-		return analysis
-	}
-
-	memoryIncrease := current.RuntimeStats.Alloc - baseline.RuntimeStats.Alloc
-	if memoryIncrease > 5*1024*1024 {
-		analysis.HasLeak = true
-		analysis.SuspectedLeaks = append(analysis.SuspectedLeaks,
-			"Memory pool operations caused significant memory increase")
-		analysis.Recommendations = append(analysis.Recommendations,
-			"Check for objects not being returned to memory pools properly")
-	}
-
-	return analysis
-}
+// Deprecated profilers removed - use internal/pool statistics instead
+// The centralized pool manager in internal/pool provides comprehensive
+// statistics tracking that replaces these specialized profilers
 
 // Global profiling manager instance
 var globalProfilingManager *ProfilingManager

profiling_test.go

@@ -150,17 +150,8 @@ func TestComponentProfilers(t *testing.T) {
 		t.Fatal("HTTP client snapshot is nil")
 	}
 
-	// Test Token Compression Profiler
-	compressionPool := NewTokenCompressionPool()
-	tcp := NewTokenCompressionProfiler(compressionPool, logger)
-	snapshot, err = tcp.TakeSnapshot()
-	if err != nil {
-		t.Fatalf("Failed to take compression snapshot: %v", err)
-	}
-
-	if snapshot == nil {
-		t.Fatal("Compression snapshot is nil")
-	}
+	// Token Compression Profiler removed - use internal/pool statistics instead
+	t.Log("Token compression profiler deprecated - use internal/pool stats")
 }
 
 func TestLeakAnalysis(t *testing.T) {
@@ -621,232 +612,5 @@ func TestProviderMetadataMemoryLeakDetection(t *testing.T) {
 
 // TestMemoryPoolLeakDetection tests for memory leaks in memory pool operations
 func TestMemoryPoolLeakDetection(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping test in short mode")
-	}
-
-	logger := NewLogger("debug")
-
-	strictMode := os.Getenv("STRICT_MEMORY_TEST") == "true"
-	if strictMode {
-		t.Log("Running in strict memory test mode - will fail on detected leaks")
-	} else {
-		t.Log("Running in lenient memory test mode - will log warnings instead of failing")
-	}
-
-	config := LeakDetectionConfig{
-		EnableLeakDetection: true,
-		LeakThresholdMB:     10,
-	}
-
-	mto := NewMemoryTestOrchestrator(config, logger)
-
-	// Create memory pool manager and token compression pool
-	memoryPoolManager := NewMemoryPoolManager()
-	tokenCompressionPool := NewTokenCompressionPool()
-
-	// Create profiler for memory pools
-	profiler := NewMemoryPoolProfiler(memoryPoolManager, tokenCompressionPool, logger)
-	mto.RegisterComponent("memory_pools", profiler)
-
-	// Take initial baseline
-	baseline, err := profiler.TakeSnapshot()
-	if err != nil {
-		t.Fatalf("Failed to take baseline snapshot: %v", err)
-	}
-
-	initialGoroutines := runtime.NumGoroutine()
-
-	// Phase 1: Simulate various memory pool operations
-	t.Log("Phase 1: Testing memory pool operations with various patterns...")
-
-	// Test compression buffer pool
-	for i := 0; i < 100; i++ {
-		buf := memoryPoolManager.GetCompressionBuffer()
-		// Simulate some work with the buffer
-		buf.WriteString(fmt.Sprintf("test data %d", i))
-		// Properly return buffer to pool
-		memoryPoolManager.PutCompressionBuffer(buf)
-	}
-
-	// Test JWT parsing buffer pool
-	for i := 0; i < 50; i++ {
-		jwtBuf := memoryPoolManager.GetJWTParsingBuffer()
-		// Simulate JWT parsing operations
-		jwtBuf.HeaderBuf = append(jwtBuf.HeaderBuf, []byte("header")...)
-		jwtBuf.PayloadBuf = append(jwtBuf.PayloadBuf, []byte("payload")...)
-		jwtBuf.SignatureBuf = append(jwtBuf.SignatureBuf, []byte("signature")...)
-		// Properly return buffer to pool
-		memoryPoolManager.PutJWTParsingBuffer(jwtBuf)
-	}
-
-	// Test HTTP response buffer pool
-	for i := 0; i < 75; i++ {
-		httpBuf := memoryPoolManager.GetHTTPResponseBuffer()
-		// Simulate HTTP response processing
-		copy(httpBuf[:min(len(httpBuf), 100)], []byte("http response data"))
-		// Properly return buffer to pool
-		memoryPoolManager.PutHTTPResponseBuffer(httpBuf)
-	}
-
-	// Test string builder pool
-	for i := 0; i < 60; i++ {
-		sb := memoryPoolManager.GetStringBuilder()
-		// Simulate string building operations
-		sb.WriteString(fmt.Sprintf("built string %d", i))
-		_ = sb.String() // Use the result
-		// Properly return string builder to pool
-		memoryPoolManager.PutStringBuilder(sb)
-	}
-
-	// Test token compression pool
-	for i := 0; i < 40; i++ {
-		compBuf := tokenCompressionPool.GetCompressionBuffer()
-		// Simulate compression operations
-		compBuf.WriteString(fmt.Sprintf("compress data %d", i))
-		// Properly return buffer to pool
-		tokenCompressionPool.PutCompressionBuffer(compBuf)
-
-		decompBuf := tokenCompressionPool.GetDecompressionBuffer()
-		// Simulate decompression operations
-		decompBuf.WriteString(fmt.Sprintf("decompress data %d", i))
-		// Properly return buffer to pool
-		tokenCompressionPool.PutDecompressionBuffer(decompBuf)
-
-		sb := tokenCompressionPool.GetStringBuilder()
-		// Simulate string operations
-		sb.WriteString(fmt.Sprintf("token string %d", i))
-		_ = sb.String()
-		// Properly return string builder to pool
-		tokenCompressionPool.PutStringBuilder(sb)
-	}
-
-	// Take intermediate snapshot
-	intermediate, err := profiler.TakeSnapshot()
-	if err != nil {
-		t.Fatalf("Failed to take intermediate snapshot: %v", err)
-	}
-
-	// Phase 2: Continue with more intensive operations to test sustained usage
-	t.Log("Phase 2: Testing sustained memory pool usage...")
-
-	// Simulate mixed operations with varying patterns
-	for i := 0; i < 200; i++ {
-		// Mix different pool operations
-		switch i % 4 {
-		case 0:
-			buf := memoryPoolManager.GetCompressionBuffer()
-			buf.WriteString("mixed operation data")
-			memoryPoolManager.PutCompressionBuffer(buf)
-		case 1:
-			jwtBuf := memoryPoolManager.GetJWTParsingBuffer()
-			jwtBuf.HeaderBuf = append(jwtBuf.HeaderBuf, []byte("mixed")...)
-			memoryPoolManager.PutJWTParsingBuffer(jwtBuf)
-		case 2:
-			httpBuf := memoryPoolManager.GetHTTPResponseBuffer()
-			copy(httpBuf[:min(len(httpBuf), 50)], []byte("mixed http"))
-			memoryPoolManager.PutHTTPResponseBuffer(httpBuf)
-		case 3:
-			sb := memoryPoolManager.GetStringBuilder()
-			sb.WriteString("mixed string building")
-			_ = sb.String()
-			memoryPoolManager.PutStringBuilder(sb)
-		}
-	}
-
-	// Take final snapshot
-	current, err := profiler.TakeSnapshot()
-	if err != nil {
-		t.Fatalf("Failed to take current snapshot: %v", err)
-	}
-
-	finalGoroutines := runtime.NumGoroutine()
-
-	// Analyze for leaks
-	analysis := profiler.AnalyzeLeaks(baseline, current)
-
-	// Assertions for memory leaks
-	if analysis.HasLeak {
-		if strictMode {
-			t.Errorf("Memory leak detected in memory pool operations: %s", analysis.LeakDescription)
-			for _, leak := range analysis.SuspectedLeaks {
-				t.Errorf("Suspected leak: %s", leak)
-			}
-		} else {
-			t.Logf("Memory leak warning in memory pool operations: %s", analysis.LeakDescription)
-			for _, leak := range analysis.SuspectedLeaks {
-				t.Logf("Suspected leak: %s", leak)
-			}
-		}
-		for _, rec := range analysis.Recommendations {
-			t.Logf("Recommendation: %s", rec)
-		}
-	}
-
-	// Check total memory growth
-	totalMemoryIncrease := current.RuntimeStats.Alloc - baseline.RuntimeStats.Alloc
-	if totalMemoryIncrease > 15*1024*1024 { // 15MB threshold for entire test
-		if strictMode {
-			t.Errorf("Total memory usage increased by %.2f MB during memory pool operations", float64(totalMemoryIncrease)/(1024*1024))
-		} else {
-			t.Logf("Total memory usage increased by %.2f MB during memory pool operations", float64(totalMemoryIncrease)/(1024*1024))
-		}
-	}
-
-	// Check for gradual memory growth patterns
-	intermediateMemoryIncrease := intermediate.RuntimeStats.Alloc - baseline.RuntimeStats.Alloc
-	if intermediateMemoryIncrease > 8*1024*1024 { // 8MB threshold for first phase
-		if strictMode {
-			t.Errorf("Memory usage increased by %.2f MB during first phase of memory pool operations", float64(intermediateMemoryIncrease)/(1024*1024))
-		} else {
-			t.Logf("Memory usage increased by %.2f MB during first phase of memory pool operations", float64(intermediateMemoryIncrease)/(1024*1024))
-		}
-	}
-
-	// Check goroutine count stability
-	goroutineIncrease := finalGoroutines - initialGoroutines
-	if goroutineIncrease > 3 { // Allow small variance for test environment
-		if strictMode {
-			t.Errorf("Goroutine count increased by %d during memory pool operations (initial: %d, final: %d)",
-				goroutineIncrease, initialGoroutines, finalGoroutines)
-		} else {
-			t.Logf("Goroutine count increased by %d during memory pool operations (initial: %d, final: %d)",
-				goroutineIncrease, initialGoroutines, finalGoroutines)
-		}
-	}
-
-	// Phase 3: Test cleanup verification
-	t.Log("Phase 3: Testing cleanup verification...")
-
-	// Force garbage collection to see if pools are properly managed
-	runtime.GC()
-	runtime.GC() // Run twice to ensure cleanup
-
-	time.Sleep(GetTestDuration(10 * time.Millisecond)) // Allow cleanup to complete
-
-	// Take post-cleanup snapshot
-	postCleanup, err := profiler.TakeSnapshot()
-	if err != nil {
-		t.Fatalf("Failed to take post-cleanup snapshot: %v", err)
-	}
-
-	// Check if memory decreased after cleanup
-	if postCleanup.RuntimeStats.Alloc < current.RuntimeStats.Alloc {
-		memoryDecrease := current.RuntimeStats.Alloc - postCleanup.RuntimeStats.Alloc
-		t.Logf("Memory decreased by %.2f MB after cleanup phase", float64(memoryDecrease)/(1024*1024))
-	} else if postCleanup.RuntimeStats.Alloc > current.RuntimeStats.Alloc {
-		memoryIncrease := postCleanup.RuntimeStats.Alloc - current.RuntimeStats.Alloc
-		if strictMode {
-			t.Errorf("Memory increased by %.2f MB after cleanup phase - possible cleanup issues", float64(memoryIncrease)/(1024*1024))
-		} else {
-			t.Logf("Memory increased by %.2f MB after cleanup phase - possible cleanup issues", float64(memoryIncrease)/(1024*1024))
-		}
-	}
-
-	t.Logf("Memory pool leak detection test completed")
-	t.Logf("Memory usage: baseline=%.2f MB, intermediate=%.2f MB, final=%.2f MB, post-cleanup=%.2f MB",
-		float64(baseline.RuntimeStats.Alloc)/(1024*1024),
-		float64(intermediate.RuntimeStats.Alloc)/(1024*1024),
-		float64(current.RuntimeStats.Alloc)/(1024*1024),
-		float64(postCleanup.RuntimeStats.Alloc)/(1024*1024))
+	t.Skip("Deprecated - memory pool profilers removed. Use internal/pool statistics instead")
 }

session.go

@@ -5,6 +5,7 @@ import (
 	"compress/gzip"
 	"context"
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
@@ -17,8 +18,18 @@ import (
 	"time"
 
 	"github.com/gorilla/sessions"
+	"github.com/lukaszraczylo/traefikoidc/internal/pool"
 )
 
+// constantTimeStringCompare performs a constant-time comparison of two strings
+// to prevent timing attacks. Returns true if the strings are equal.
+func constantTimeStringCompare(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
+}
+
 // min returns the minimum of two integers.
 // This is a utility function used throughout the session management code.
 // Parameters:
@@ -91,9 +102,9 @@ func compressToken(token string) string {
 		return token
 	}
 
-	pools := GetGlobalMemoryPools()
-	b := pools.GetCompressionBuffer()
-	defer pools.PutCompressionBuffer(b)
+	pm := pool.Get()
+	b := pm.GetBuffer(4096)
+	defer pm.PutBuffer(b)
 
 	gz := gzip.NewWriter(b)
 
@@ -171,9 +182,9 @@ func decompressTokenInternal(compressed string) string {
 		return compressed
 	}
 
-	pools := GetGlobalMemoryPools()
-	readerBuf := pools.GetHTTPResponseBuffer()
-	defer pools.PutHTTPResponseBuffer(readerBuf)
+	pm := pool.Get()
+	readerBuf := pm.GetHTTPResponseBuffer()
+	defer pm.PutHTTPResponseBuffer(readerBuf)
 
 	gz, err := gzip.NewReader(bytes.NewReader(data))
 	if err != nil {
@@ -272,7 +283,7 @@ func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain strin
 
 	// Start memory monitoring every 30 seconds (will skip if already started)
 	if err := sm.memoryMonitor.Start(30 * time.Second); err != nil {
-		logger.Infof("Failed to start memory monitoring: %v", err)
+		logger.Debugf("Failed to start memory monitoring: %v", err)
 	}
 
 	sm.sessionPool.New = func() interface{} {
@@ -302,7 +313,7 @@ func (sm *SessionManager) Shutdown() error {
 	var shutdownErr error
 	sm.shutdownOnce.Do(func() {
 		if sm.logger != nil {
-			sm.logger.Info("SessionManager shutdown initiated")
+			sm.logger.Debug("SessionManager shutdown initiated")
 		}
 
 		// Cancel context to stop all background operations
@@ -324,7 +335,7 @@ func (sm *SessionManager) Shutdown() error {
 		runtime.GC()
 
 		if sm.logger != nil {
-			sm.logger.Info("SessionManager shutdown completed")
+			sm.logger.Debug("SessionManager shutdown completed")
 		}
 	})
 	return shutdownErr
@@ -1331,7 +1342,7 @@ func (sd *SessionData) SetAccessToken(token string) {
 	}
 
 	currentAccessToken := sd.getAccessTokenUnsafe()
-	if currentAccessToken == token {
+	if constantTimeStringCompare(currentAccessToken, token) {
 		return
 	}
 	sd.dirty = true
@@ -1547,7 +1558,7 @@ func (sd *SessionData) SetRefreshToken(token string) {
 			}
 		}
 	}
-	if currentRefreshToken == token {
+	if constantTimeStringCompare(currentRefreshToken, token) {
 		return
 	}
 	sd.dirty = true
@@ -2060,7 +2071,7 @@ func (sd *SessionData) SetIDToken(token string) {
 		return
 	}
 	currentIDToken := sd.getIDTokenUnsafe()
-	if currentIDToken == token {
+	if constantTimeStringCompare(currentIDToken, token) {
 		return
 	}
 	sd.dirty = true

session_chunk_manager.go

@@ -1,9 +1,9 @@
 package traefikoidc
 
 import (
+	"bytes"
 	"context"
 	"encoding/base64"
-	"encoding/json"
 	"fmt"
 	"runtime"
 	"strings"
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/gorilla/sessions"
+	"github.com/lukaszraczylo/traefikoidc/internal/pool"
 )
 
 // TokenConfig defines validation and storage parameters for different token types.
@@ -981,9 +982,13 @@ func (cm *ChunkManager) extractJWTExpiration(token string) (*time.Time, error) {
 		return nil, fmt.Errorf("failed to decode JWT payload: %w", err)
 	}
 
-	// Parse the JSON payload
+	// Parse the JSON payload using pooled decoder
 	var claims map[string]interface{}
-	if err := json.Unmarshal(payload, &claims); err != nil {
+	pm := pool.Get()
+	decoder := pm.GetJSONDecoder(bytes.NewReader(payload))
+	defer pm.PutJSONDecoder(decoder)
+
+	if err := decoder.Decode(&claims); err != nil {
 		return nil, fmt.Errorf("failed to parse JWT claims: %w", err)
 	}
 
@@ -1067,9 +1072,13 @@ func (cm *ChunkManager) extractJWTIssuedAt(token string) (*time.Time, error) {
 		return nil, fmt.Errorf("failed to decode JWT payload: %w", err)
 	}
 
-	// Parse the JSON payload
+	// Parse the JSON payload using pooled decoder
 	var claims map[string]interface{}
-	if err := json.Unmarshal(payload, &claims); err != nil {
+	pm := pool.Get()
+	decoder := pm.GetJSONDecoder(bytes.NewReader(payload))
+	defer pm.PutJSONDecoder(decoder)
+
+	if err := decoder.Decode(&claims); err != nil {
 		return nil, fmt.Errorf("failed to parse JWT claims: %w", err)
 	}
 

string_builder_pool.go

@@ -1,109 +0,0 @@
-package traefikoidc
-
-import (
-	"strings"
-	"sync"
-)
-
-// StringBuilderPool manages a pool of string builders for efficient string operations
-type StringBuilderPool struct {
-	pool sync.Pool
-}
-
-var (
-	globalStringBuilderPool     *StringBuilderPool
-	globalStringBuilderPoolOnce sync.Once
-)
-
-// GetGlobalStringBuilderPool returns the global string builder pool
-func GetGlobalStringBuilderPool() *StringBuilderPool {
-	globalStringBuilderPoolOnce.Do(func() {
-		globalStringBuilderPool = &StringBuilderPool{
-			pool: sync.Pool{
-				New: func() interface{} {
-					return &strings.Builder{}
-				},
-			},
-		}
-	})
-	return globalStringBuilderPool
-}
-
-// Get retrieves a string builder from the pool
-func (p *StringBuilderPool) Get() *strings.Builder {
-	sb := p.pool.Get().(*strings.Builder)
-	sb.Reset() // Ensure it's clean
-	return sb
-}
-
-// Put returns a string builder to the pool
-func (p *StringBuilderPool) Put(sb *strings.Builder) {
-	if sb == nil {
-		return
-	}
-	// Only return to pool if not too large (avoid keeping huge buffers)
-	if sb.Cap() <= 4096 {
-		sb.Reset()
-		p.pool.Put(sb)
-	}
-}
-
-// FormatString efficiently formats a string using the pool
-func (p *StringBuilderPool) FormatString(format func(*strings.Builder)) string {
-	sb := p.Get()
-	defer p.Put(sb)
-	format(sb)
-	return sb.String()
-}
-
-// BuildSessionName efficiently builds session names
-func BuildSessionName(baseName string, index int) string {
-	pool := GetGlobalStringBuilderPool()
-	return pool.FormatString(func(sb *strings.Builder) {
-		sb.WriteString(baseName)
-		sb.WriteRune('_')
-		// Efficient int to string conversion
-		if index < 10 {
-			sb.WriteRune('0' + rune(index))
-		} else {
-			sb.WriteString(sbIntToString(index))
-		}
-	})
-}
-
-// BuildCacheKey efficiently builds cache keys
-func BuildCacheKey(parts ...string) string {
-	pool := GetGlobalStringBuilderPool()
-	return pool.FormatString(func(sb *strings.Builder) {
-		for i, part := range parts {
-			if i > 0 {
-				sb.WriteRune(':')
-			}
-			sb.WriteString(part)
-		}
-	})
-}
-
-// sbIntToString converts int to string without allocation (for small numbers)
-func sbIntToString(n int) string {
-	if n < 0 {
-		return "-" + sbIntToString(-n)
-	}
-	if n < 10 {
-		return string(rune('0' + n))
-	}
-	if n < 100 {
-		return string(rune('0'+n/10)) + string(rune('0'+n%10))
-	}
-	// Fall back to standard conversion for larger numbers
-	buf := make([]byte, 0, 20)
-	for n > 0 {
-		buf = append(buf, byte('0'+n%10))
-		n /= 10
-	}
-	// Reverse the buffer
-	for i, j := 0, len(buf)-1; i < j; i, j = i+1, j-1 {
-		buf[i], buf[j] = buf[j], buf[i]
-	}
-	return string(buf)
-}

token_manager.go

@@ -0,0 +1,962 @@
+// Package traefikoidc provides OIDC authentication middleware for Traefik.
+// This file contains token management functionality including verification,
+// caching, refresh, and provider-specific validation logic.
+package traefikoidc
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// ============================================================================
+// TOKEN VERIFICATION
+// ============================================================================
+
+// VerifyToken verifies the validity of an ID token or access token.
+// It performs comprehensive validation including format checks, blacklist verification,
+// signature validation using JWKs, and standard claims validation. It also caches
+// successfully verified tokens to avoid repeated verification.
+// Parameters:
+//   - token: The JWT token string to verify.
+//
+// Returns:
+//   - An error if verification fails (e.g., blacklisted token, invalid format,
+//     signature failure, or claims error), nil if verification succeeds.
+func (t *TraefikOidc) VerifyToken(token string) error {
+	if token == "" {
+		return fmt.Errorf("invalid JWT format: token is empty")
+	}
+
+	if strings.Count(token, ".") != 2 {
+		return fmt.Errorf("invalid JWT format: expected JWT with 3 parts, got %d parts", strings.Count(token, ".")+1)
+	}
+
+	if len(token) < 10 {
+		return fmt.Errorf("token too short to be valid JWT")
+	}
+
+	if t.tokenBlacklist != nil {
+		if blacklisted, exists := t.tokenBlacklist.Get(token); exists && blacklisted != nil {
+			return fmt.Errorf("token is blacklisted (raw string) in cache")
+		}
+	}
+
+	parsedJWT, parseErr := parseJWT(token)
+	if parseErr != nil {
+		return fmt.Errorf("failed to parse JWT for blacklist check: %w", parseErr)
+	}
+
+	tokenType := "UNKNOWN"
+	if aud, ok := parsedJWT.Claims["aud"]; ok {
+		if audStr, ok := aud.(string); ok && audStr == t.clientID {
+			tokenType = "ID_TOKEN"
+		}
+	}
+	if scope, ok := parsedJWT.Claims["scope"]; ok {
+		if _, ok := scope.(string); ok {
+			tokenType = "ACCESS_TOKEN"
+		}
+	}
+
+	if jti, ok := parsedJWT.Claims["jti"].(string); ok && jti != "" {
+		if !strings.HasPrefix(token, "eyJhbGciOiJSUzI1NiIsImtpZCI6InRlc3Qta2V5LWlkIiwidHlwIjoiSldUIn0") {
+			if t.tokenBlacklist != nil {
+				if blacklisted, exists := t.tokenBlacklist.Get(jti); exists && blacklisted != nil {
+					return fmt.Errorf("token replay detected (jti: %s) in cache", jti)
+				}
+			}
+		}
+	}
+
+	if claims, exists := t.tokenCache.Get(token); exists && len(claims) > 0 {
+		return nil
+	}
+
+	if !t.limiter.Allow() {
+		return fmt.Errorf("rate limit exceeded")
+	}
+
+	jwt := parsedJWT
+
+	if err := t.VerifyJWTSignatureAndClaims(jwt, token); err != nil {
+		if !strings.Contains(err.Error(), "token has expired") {
+			t.safeLogErrorf("%s token verification failed: %v", tokenType, err)
+		}
+		return err
+	}
+
+	t.cacheVerifiedToken(token, jwt.Claims)
+
+	if jti, ok := jwt.Claims["jti"].(string); ok && jti != "" {
+		expiry := time.Now().Add(defaultBlacklistDuration)
+		if expClaim, expOk := jwt.Claims["exp"].(float64); expOk {
+			expTime := time.Unix(int64(expClaim), 0)
+			tokenDuration := time.Until(expTime)
+			if tokenDuration > defaultBlacklistDuration && tokenDuration < (24*time.Hour) {
+				expiry = expTime
+			} else if tokenDuration <= 0 {
+				expiry = time.Now().Add(defaultBlacklistDuration)
+			} else {
+				expiry = time.Now().Add(defaultBlacklistDuration)
+			}
+		}
+
+		if t.tokenBlacklist != nil {
+			t.tokenBlacklist.Set(jti, true, time.Until(expiry))
+			t.safeLogDebugf("Added JTI %s to blacklist cache", jti)
+		} else {
+			t.safeLogErrorf("Token blacklist not available, skipping JTI %s blacklist", jti)
+		}
+
+		replayCacheMu.Lock()
+		if replayCache == nil {
+			initReplayCache()
+		}
+		duration := time.Until(expiry)
+		if duration > 0 {
+			replayCache.Set(jti, true, duration)
+		}
+		replayCacheMu.Unlock()
+	}
+
+	return nil
+}
+
+// verifyToken is a convenience wrapper for token verification.
+// It delegates to the configured token verifier interface.
+// Parameters:
+//   - token: The token string to verify.
+//
+// Returns:
+//   - The result of calling t.tokenVerifier.VerifyToken(token).
+func (t *TraefikOidc) verifyToken(token string) error {
+	return t.tokenVerifier.VerifyToken(token)
+}
+
+// cacheVerifiedToken stores a successfully verified token and its claims in the cache.
+// The token is cached until its expiration time to avoid repeated verification.
+// Parameters:
+//   - token: The verified token string to cache.
+//   - claims: The map of claims extracted from the verified token.
+func (t *TraefikOidc) cacheVerifiedToken(token string, claims map[string]interface{}) {
+	expClaim, ok := claims["exp"].(float64)
+	if !ok {
+		t.safeLogError("Failed to cache token: invalid 'exp' claim type")
+		return
+	}
+
+	expirationTime := time.Unix(int64(expClaim), 0)
+	now := time.Now()
+	duration := expirationTime.Sub(now)
+	t.tokenCache.Set(token, claims, duration)
+}
+
+// VerifyJWTSignatureAndClaims verifies JWT signature using provider's public keys and validates standard claims.
+// It retrieves the appropriate public key from the JWKS cache, verifies the token signature,
+// and validates standard OIDC claims like issuer, audience, and expiration.
+// Parameters:
+//   - jwt: The parsed JWT structure containing header and claims.
+//   - token: The raw token string for signature verification.
+//
+// Returns:
+//   - An error if verification fails (e.g., JWKS retrieval failed, no matching key,
+//     signature verification failed, standard claim validation failed), nil if successful.
+func (t *TraefikOidc) VerifyJWTSignatureAndClaims(jwt *JWT, token string) error {
+	t.safeLogDebugf("Verifying JWT signature and claims")
+
+	jwks, err := t.jwkCache.GetJWKS(context.Background(), t.jwksURL, t.httpClient)
+	if err != nil {
+		return fmt.Errorf("failed to get JWKS: %w", err)
+	}
+
+	if !t.suppressDiagnosticLogs && jwks != nil {
+		t.safeLogDebugf("DIAGNOSTIC: Retrieved JWKS with %d keys from URL: %s", len(jwks.Keys), t.jwksURL)
+	}
+
+	kid, ok := jwt.Header["kid"].(string)
+	if !ok {
+		return fmt.Errorf("missing key ID in token header")
+	}
+	alg, ok := jwt.Header["alg"].(string)
+	if !ok {
+		return fmt.Errorf("missing algorithm in token header")
+	}
+
+	if !t.suppressDiagnosticLogs {
+		t.safeLogDebugf("DIAGNOSTIC: Looking for kid=%s, alg=%s in JWKS", kid, alg)
+	}
+
+	if jwks == nil {
+		return fmt.Errorf("JWKS is nil, cannot verify token")
+	}
+
+	// Find the matching key in JWKS
+	var matchingKey *JWK
+	availableKids := make([]string, 0, len(jwks.Keys))
+	for _, key := range jwks.Keys {
+		availableKids = append(availableKids, key.Kid)
+		if key.Kid == kid {
+			matchingKey = &key
+			break
+		}
+	}
+
+	if matchingKey == nil {
+		if !t.suppressDiagnosticLogs {
+			t.safeLogErrorf("DIAGNOSTIC: No matching key found for kid=%s. Available kids: %v", kid, availableKids)
+		}
+		return fmt.Errorf("no matching public key found for kid: %s", kid)
+	}
+
+	if !t.suppressDiagnosticLogs {
+		t.safeLogDebugf("DIAGNOSTIC: Found matching key for kid=%s, key type: %s", kid, matchingKey.Kty)
+	}
+
+	publicKeyPEM, err := jwkToPEM(matchingKey)
+	if err != nil {
+		return fmt.Errorf("failed to convert JWK to PEM: %w", err)
+	}
+
+	if err := verifySignature(token, publicKeyPEM, alg); err != nil {
+		if !t.suppressDiagnosticLogs {
+			t.safeLogErrorf("DIAGNOSTIC: Signature verification failed for kid=%s, alg=%s: %v", kid, alg, err)
+		}
+		return fmt.Errorf("signature verification failed: %w", err)
+	}
+
+	if !t.suppressDiagnosticLogs {
+		t.safeLogDebugf("DIAGNOSTIC: Signature verification successful for kid=%s", kid)
+	}
+
+	if err := jwt.Verify(t.issuerURL, t.clientID, true); err != nil {
+		return fmt.Errorf("standard claim verification failed: %w", err)
+	}
+
+	return nil
+}
+
+// ============================================================================
+// TOKEN REFRESH & MANAGEMENT
+// ============================================================================
+
+// refreshToken attempts to refresh authentication tokens using the refresh token.
+// It handles provider-specific refresh logic, validates new tokens, updates the session,
+// and includes concurrency protection to prevent race conditions.
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The HTTP request context.
+//   - session: The session data containing the refresh token.
+//
+// Returns:
+//   - true if refresh succeeded and session was updated, false if refresh failed,
+//     a concurrency conflict was detected, or saving the session failed.
+func (t *TraefikOidc) refreshToken(rw http.ResponseWriter, req *http.Request, session *SessionData) bool {
+	session.refreshMutex.Lock()
+	defer session.refreshMutex.Unlock()
+
+	t.logger.Debug("Attempting to refresh token (mutex acquired)")
+
+	if !session.inUse {
+		t.logger.Debug("refreshToken aborted: Session no longer in use")
+		return false
+	}
+
+	initialRefreshToken := session.GetRefreshToken()
+	if initialRefreshToken == "" {
+		t.logger.Debug("No refresh token found in session")
+		return false
+	}
+
+	if t.isGoogleProvider() {
+		t.logger.Debug("Google OIDC provider detected for token refresh operation")
+	} else if t.isAzureProvider() {
+		t.logger.Debug("Azure AD provider detected for token refresh operation")
+	}
+
+	tokenPrefix := initialRefreshToken
+	if len(initialRefreshToken) > 10 {
+		tokenPrefix = initialRefreshToken[:10]
+	}
+	t.logger.Debugf("Attempting refresh with token starting with %s...", tokenPrefix)
+
+	newToken, err := t.tokenExchanger.GetNewTokenWithRefreshToken(initialRefreshToken)
+	if err != nil {
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "invalid_grant") || strings.Contains(errMsg, "token expired") {
+			t.logger.Debug("Refresh token expired or revoked: %v", err)
+			// Clear all tokens and authentication state when refresh token is invalid
+			session.SetAuthenticated(false)
+			session.SetRefreshToken("")
+			session.SetAccessToken("")
+			session.SetIDToken("")
+			session.SetEmail("")
+			// Clear CSRF tokens as well to prevent any replay attacks
+			session.SetCSRF("")
+			session.SetNonce("")
+			session.SetCodeVerifier("")
+			if err = session.Save(req, rw); err != nil {
+				t.logger.Errorf("Failed to clear session after invalid refresh token: %v", err)
+			}
+		} else if strings.Contains(errMsg, "invalid_client") {
+			t.logger.Errorf("Client credentials rejected: %v - check client_id and client_secret configuration", err)
+		} else if t.isGoogleProvider() && strings.Contains(errMsg, "invalid_request") {
+			t.logger.Errorf("Google OIDC provider error: %v - check scope configuration includes 'offline_access' and prompt=consent is used during authentication", err)
+		} else {
+			t.logger.Errorf("Token refresh failed: %v", err)
+		}
+
+		return false
+	}
+
+	if newToken.IDToken == "" {
+		t.logger.Info("Provider did not return a new ID token during refresh")
+		return false
+	}
+
+	if err = t.verifyToken(newToken.IDToken); err != nil {
+		t.logger.Debug("Failed to verify newly obtained ID token: %v", err)
+		return false
+	}
+
+	currentRefreshToken := session.GetRefreshToken()
+	if initialRefreshToken != currentRefreshToken {
+		t.logger.Infof("refreshToken aborted: Session refresh token changed concurrently during refresh attempt.")
+		return false
+	}
+
+	t.logger.Debugf("Concurrency check passed. Updating session with new tokens.")
+
+	claims, err := t.extractClaimsFunc(newToken.IDToken)
+	if err != nil {
+		t.logger.Errorf("refreshToken failed: Failed to extract claims from refreshed token: %v", err)
+		return false
+	}
+	email, _ := claims["email"].(string)
+	if email == "" {
+		t.logger.Errorf("refreshToken failed: Email claim missing or empty in refreshed token")
+		return false
+	}
+	session.SetEmail(email)
+
+	// Get token expiry information for logging
+	var expiryTime time.Time
+	if expClaim, ok := claims["exp"].(float64); ok {
+		expiryTime = time.Unix(int64(expClaim), 0)
+		t.logger.Debugf("New token expires at: %v (in %v)", expiryTime, time.Until(expiryTime))
+	}
+
+	session.SetIDToken(newToken.IDToken)
+	session.SetAccessToken(newToken.AccessToken)
+
+	if newToken.RefreshToken != "" {
+		t.logger.Debug("Received new refresh token from provider")
+		session.SetRefreshToken(newToken.RefreshToken)
+	} else {
+		t.logger.Debug("Provider did not return a new refresh token, keeping the existing one")
+		session.SetRefreshToken(initialRefreshToken)
+	}
+
+	if err := session.SetAuthenticated(true); err != nil {
+		t.logger.Errorf("refreshToken failed: Failed to set authenticated flag: %v", err)
+		// Clear tokens on failure to maintain consistent state
+		session.SetAccessToken("")
+		session.SetIDToken("")
+		session.SetRefreshToken("")
+		session.SetEmail("")
+		return false
+	}
+
+	if err := session.Save(req, rw); err != nil {
+		t.logger.Errorf("refreshToken failed: Failed to save session after successful token refresh: %v", err)
+		// Reset authentication state since we couldn't persist it
+		session.SetAuthenticated(false)
+		return false
+	}
+
+	t.logger.Debugf("Token refresh successful and session saved")
+	return true
+}
+
+// ============================================================================
+// TOKEN REVOCATION
+// ============================================================================
+
+// RevokeToken revokes a token locally by adding it to the blacklist cache.
+// It removes the token from the verification cache and adds both the token
+// and its JTI (if present) to the blacklist to prevent future use.
+// Parameters:
+//   - token: The raw token string to revoke locally.
+func (t *TraefikOidc) RevokeToken(token string) {
+	t.tokenCache.Delete(token)
+
+	if jwt, err := parseJWT(token); err == nil {
+		if jti, ok := jwt.Claims["jti"].(string); ok && jti != "" {
+			expiry := time.Now().Add(24 * time.Hour)
+			if t.tokenBlacklist != nil {
+				t.tokenBlacklist.Set(jti, true, time.Until(expiry))
+				t.logger.Debugf("Locally revoked token JTI %s (added to blacklist)", jti)
+			}
+		}
+	}
+
+	expiry := time.Now().Add(24 * time.Hour)
+	if t.tokenBlacklist != nil {
+		t.tokenBlacklist.Set(token, true, time.Until(expiry))
+		t.logger.Debugf("Locally revoked token (added to blacklist)")
+	}
+}
+
+// RevokeTokenWithProvider revokes a token with the OIDC provider.
+// It sends a revocation request to the provider's revocation endpoint
+// with proper authentication and error recovery if available.
+// Parameters:
+//   - token: The token to revoke.
+//   - tokenType: The type of token ("access_token" or "refresh_token").
+//
+// Returns:
+//   - An error if the request fails or the provider returns a non-OK status.
+func (t *TraefikOidc) RevokeTokenWithProvider(token, tokenType string) error {
+	if t.revocationURL == "" {
+		return fmt.Errorf("token revocation endpoint is not configured or discovered")
+	}
+	t.logger.Debugf("Attempting to revoke token (type: %s) with provider at %s", tokenType, t.revocationURL)
+
+	data := url.Values{
+		"token":           {token},
+		"token_type_hint": {tokenType},
+		"client_id":       {t.clientID},
+		"client_secret":   {t.clientSecret},
+	}
+
+	req, err := http.NewRequestWithContext(context.Background(), "POST", t.revocationURL, strings.NewReader(data.Encode()))
+	if err != nil {
+		return fmt.Errorf("failed to create token revocation request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+
+	// Send the request with circuit breaker protection if available
+	var resp *http.Response
+	if t.errorRecoveryManager != nil {
+		serviceName := fmt.Sprintf("token-revocation-%s", t.issuerURL)
+		err = t.errorRecoveryManager.ExecuteWithRecovery(context.Background(), serviceName, func() error {
+			var reqErr error
+			resp, reqErr = t.httpClient.Do(req)
+			return reqErr
+		})
+	} else {
+		resp, err = t.httpClient.Do(req)
+	}
+	if err != nil {
+		return fmt.Errorf("failed to send token revocation request: %w", err)
+	}
+	defer func() {
+		io.Copy(io.Discard, resp.Body)
+		resp.Body.Close()
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		limitReader := io.LimitReader(resp.Body, 1024*10)
+		body, _ := io.ReadAll(limitReader)
+		t.logger.Errorf("Token revocation failed with status %d: %s", resp.StatusCode, string(body))
+		return fmt.Errorf("token revocation failed with status %d", resp.StatusCode)
+	}
+
+	t.logger.Debugf("Token successfully revoked with provider")
+	return nil
+}
+
+// ============================================================================
+// TOKEN EXCHANGE OPERATIONS
+// ============================================================================
+
+// ExchangeCodeForToken exchanges an authorization code for tokens.
+// This is a wrapper method that delegates to the internal token exchange logic
+// while still allowing mocking for tests.
+// Parameters:
+//   - ctx: The request context.
+//   - grantType: The OAuth 2.0 grant type ("authorization_code").
+//   - codeOrToken: The authorization code received from the provider.
+//   - redirectURL: The redirect URI used in the authorization request.
+//   - codeVerifier: The PKCE code verifier (if PKCE is enabled).
+//
+// Returns:
+//   - The token response containing access token, ID token, and refresh token.
+//   - An error if the token exchange fails.
+func (t *TraefikOidc) ExchangeCodeForToken(ctx context.Context, grantType string, codeOrToken string, redirectURL string, codeVerifier string) (*TokenResponse, error) {
+	return t.exchangeTokens(ctx, grantType, codeOrToken, redirectURL, codeVerifier)
+}
+
+// GetNewTokenWithRefreshToken refreshes tokens using a refresh token.
+// This is a wrapper method that delegates to the internal refresh token logic
+// while still allowing mocking for tests.
+// Parameters:
+//   - refreshToken: The refresh token to use for obtaining new tokens.
+//
+// Returns:
+//   - The token response containing new access token, ID token, and potentially new refresh token.
+//   - An error if the refresh fails.
+func (t *TraefikOidc) GetNewTokenWithRefreshToken(refreshToken string) (*TokenResponse, error) {
+	return t.getNewTokenWithRefreshToken(refreshToken)
+}
+
+// ============================================================================
+// PROVIDER DETECTION
+// ============================================================================
+
+// isGoogleProvider detects if the configured OIDC provider is Google.
+// It checks the issuer URL for Google-specific domains.
+// Returns:
+//   - true if the provider is Google, false otherwise.
+func (t *TraefikOidc) isGoogleProvider() bool {
+	return strings.Contains(t.issuerURL, "google") || strings.Contains(t.issuerURL, "accounts.google.com")
+}
+
+// isAzureProvider detects if the configured OIDC provider is Azure AD.
+// It checks the issuer URL for Microsoft Azure AD domains.
+// Returns:
+//   - true if the provider is Azure AD, false otherwise.
+func (t *TraefikOidc) isAzureProvider() bool {
+	return strings.Contains(t.issuerURL, "login.microsoftonline.com") ||
+		strings.Contains(t.issuerURL, "sts.windows.net") ||
+		strings.Contains(t.issuerURL, "login.windows.net")
+}
+
+// ============================================================================
+// PROVIDER VALIDATION
+// ============================================================================
+
+// validateAzureTokens validates tokens with Azure AD-specific logic.
+// Azure tokens may be opaque access tokens that cannot be verified as JWTs,
+// so this method handles both JWT and opaque token scenarios.
+// Parameters:
+//   - session: The session data containing tokens to validate.
+//
+// Returns:
+//   - authenticated: Whether the user has valid authentication.
+//   - needsRefresh: Whether tokens need to be refreshed.
+//   - expired: Whether tokens have expired and cannot be refreshed.
+func (t *TraefikOidc) validateAzureTokens(session *SessionData) (bool, bool, bool) {
+	if !session.GetAuthenticated() {
+		t.logger.Debug("Azure user is not authenticated according to session flag")
+		if session.GetRefreshToken() != "" {
+			t.logger.Debug("Azure session not authenticated, but refresh token exists. Signaling need for refresh.")
+			return false, true, false
+		}
+		return false, true, false
+	}
+
+	accessToken := session.GetAccessToken()
+	idToken := session.GetIDToken()
+
+	if accessToken != "" {
+		if strings.Count(accessToken, ".") == 2 {
+			if err := t.verifyToken(accessToken); err != nil {
+				if idToken != "" {
+					if err := t.verifyToken(idToken); err != nil {
+						t.logger.Debugf("Azure: Both access and ID token validation failed: %v", err)
+						if session.GetRefreshToken() != "" {
+							return false, true, false
+						}
+						return false, false, true
+					}
+					return t.validateTokenExpiry(session, idToken)
+				}
+				if session.GetRefreshToken() != "" {
+					return false, true, false
+				}
+				return false, false, true
+			}
+			return t.validateTokenExpiry(session, accessToken)
+		} else {
+			t.logger.Debug("Azure access token appears opaque, treating as valid")
+			if idToken != "" {
+				return t.validateTokenExpiry(session, idToken)
+			}
+			return true, false, false
+		}
+	}
+
+	if idToken != "" {
+		if err := t.verifyToken(idToken); err != nil {
+			if strings.Contains(err.Error(), "token has expired") {
+				if session.GetRefreshToken() != "" {
+					return false, true, false
+				}
+				return false, false, true
+			}
+			if session.GetRefreshToken() != "" {
+				return false, true, false
+			}
+			return false, false, true
+		}
+		return t.validateTokenExpiry(session, idToken)
+	}
+
+	if session.GetRefreshToken() != "" {
+		return false, true, false
+	}
+	return false, false, true
+}
+
+// validateGoogleTokens handles Google-specific token validation logic.
+// Currently delegates to standard token validation but provides a hook
+// for Google-specific validation requirements in the future.
+// Parameters:
+//   - session: The session data containing tokens to validate.
+//
+// Returns:
+//   - authenticated: Whether the user has valid authentication.
+//   - needsRefresh: Whether tokens need to be refreshed.
+//   - expired: Whether tokens have expired and cannot be refreshed.
+func (t *TraefikOidc) validateGoogleTokens(session *SessionData) (bool, bool, bool) {
+	return t.validateStandardTokens(session)
+}
+
+// validateStandardTokens handles standard OIDC token validation logic.
+// This is the default validation method for generic OIDC providers.
+// It verifies ID tokens and handles access tokens appropriately.
+// Parameters:
+//   - session: The session data containing tokens to validate.
+//
+// Returns:
+//   - authenticated: Whether the user has valid authentication.
+//   - needsRefresh: Whether tokens need to be refreshed.
+//   - expired: Whether tokens have expired and cannot be refreshed.
+func (t *TraefikOidc) validateStandardTokens(session *SessionData) (bool, bool, bool) {
+	authenticated := session.GetAuthenticated()
+	// Removed debug output
+	if !authenticated {
+		t.logger.Debug("User is not authenticated according to session flag")
+		if session.GetRefreshToken() != "" {
+			t.logger.Debug("Session not authenticated, but refresh token exists. Signaling need for refresh.")
+			return false, true, false
+		}
+		return false, false, false
+	}
+
+	accessToken := session.GetAccessToken()
+	// Removed debug output
+	if accessToken == "" {
+		t.logger.Debug("Authenticated flag set, but no access token found in session")
+		if session.GetRefreshToken() != "" {
+			// Check if we have an ID token to determine if we're beyond grace period
+			// When access token is missing, check ID token expiry to determine if refresh is viable
+			idToken := session.GetIDToken()
+			t.logger.Debugf("Checking ID token for grace period: ID token present: %v", idToken != "")
+			if idToken != "" {
+				// Try to parse the ID token to check its expiry
+				parts := strings.Split(idToken, ".")
+				if len(parts) == 3 {
+					// Decode the claims part
+					claimsData, err := base64.RawURLEncoding.DecodeString(parts[1])
+					if err == nil {
+						var claims map[string]interface{}
+						if err := json.Unmarshal(claimsData, &claims); err == nil {
+							if expClaim, ok := claims["exp"].(float64); ok {
+								expTime := time.Unix(int64(expClaim), 0)
+								if time.Now().After(expTime) {
+									expiredDuration := time.Since(expTime)
+									if expiredDuration > t.refreshGracePeriod {
+										t.logger.Debugf("ID token expired beyond grace period (%v > %v), must re-authenticate",
+											expiredDuration, t.refreshGracePeriod)
+										return false, false, true // expired, cannot refresh
+									}
+									t.logger.Debugf("ID token expired %v ago, within grace period %v, allowing refresh",
+										expiredDuration, t.refreshGracePeriod)
+								}
+							}
+						}
+					}
+				}
+			}
+			t.logger.Debug("Access token missing, but refresh token exists. Signaling need for refresh.")
+			return false, true, false
+		}
+		return false, false, true
+	}
+
+	// Check if access token is opaque (doesn't have JWT structure)
+	dotCount := strings.Count(accessToken, ".")
+	isOpaqueToken := dotCount != 2
+
+	// For opaque access tokens, rely on ID token for session validation
+	if isOpaqueToken {
+		t.logger.Debugf("Access token appears to be opaque (dots: %d), validating session via ID token", dotCount)
+
+		// For opaque access tokens, check ID token for authentication status
+		idToken := session.GetIDToken()
+		if idToken == "" {
+			t.logger.Debug("Opaque access token present but no ID token found")
+			if session.GetRefreshToken() != "" {
+				t.logger.Debug("ID token missing but refresh token exists. Signaling need for refresh.")
+				return false, true, false
+			}
+			// Accept session with opaque access token even without ID token
+			// The OAuth provider validated it when issued
+			t.logger.Debug("Accepting session with opaque access token")
+			return true, false, false
+		}
+
+		// Validate ID token if present
+		if err := t.verifyToken(idToken); err != nil {
+			if strings.Contains(err.Error(), "token has expired") {
+				t.logger.Debugf("ID token expired with opaque access token, needs refresh")
+				if session.GetRefreshToken() != "" {
+					return false, true, false
+				}
+				return false, false, true
+			}
+
+			t.logger.Errorf("ID token verification failed with opaque access token: %v", err)
+			if session.GetRefreshToken() != "" {
+				return false, true, false
+			}
+			return false, false, true
+		}
+
+		// Use ID token for expiry validation
+		return t.validateTokenExpiry(session, idToken)
+	}
+
+	idToken := session.GetIDToken()
+	if idToken == "" {
+		t.logger.Debug("Authenticated flag set with access token, but no ID token found in session (possibly opaque token)")
+		session.SetAuthenticated(true)
+
+		if session.GetRefreshToken() != "" {
+			t.logger.Debug("ID token missing but refresh token exists. Signaling conditional refresh to obtain ID token.")
+			return true, true, false
+		}
+		return true, false, false
+	}
+
+	if err := t.verifyToken(idToken); err != nil {
+		if strings.Contains(err.Error(), "token has expired") {
+			t.logger.Debugf("ID token signature/claims valid but token expired, needs refresh")
+			if session.GetRefreshToken() != "" {
+				return false, true, false
+			}
+			return false, false, true
+		}
+
+		t.logger.Errorf("ID token verification failed (non-expiration): %v", err)
+		if session.GetRefreshToken() != "" {
+			t.logger.Debug("ID token verification failed, but refresh token exists. Signaling need for refresh.")
+			return false, true, false
+		}
+		return false, false, true
+	}
+
+	return t.validateTokenExpiry(session, idToken)
+}
+
+// validateTokenExpiry checks if a token is nearing expiration and needs refresh.
+// It uses the configured grace period to determine when proactive refresh should occur.
+// Parameters:
+//   - session: The session data for refresh token availability.
+//   - token: The token to check expiry for.
+//
+// Returns:
+//   - authenticated: Whether the token is currently valid.
+//   - needsRefresh: Whether the token is nearing expiration and should be refreshed.
+//   - expired: Whether the token is invalid or verification failed.
+func (t *TraefikOidc) validateTokenExpiry(session *SessionData, token string) (bool, bool, bool) {
+	cachedClaims, found := t.tokenCache.Get(token)
+	if !found {
+		t.logger.Debug("Claims not found in cache after successful token verification")
+		if session.GetRefreshToken() != "" {
+			t.logger.Debug("Claims missing post-verification, attempting refresh to recover.")
+			return false, true, false
+		}
+		return false, false, true
+	}
+
+	expClaim, ok := cachedClaims["exp"].(float64)
+	if !ok {
+		t.logger.Error("Failed to get expiration time ('exp' claim) from verified token")
+		if session.GetRefreshToken() != "" {
+			t.logger.Debug("Token missing 'exp' claim, but refresh token exists. Signaling need for refresh.")
+			return false, true, false
+		}
+		return false, false, true
+	}
+
+	expTime := int64(expClaim)
+	expTimeObj := time.Unix(expTime, 0)
+	nowObj := time.Now()
+
+	// Check if token has already expired
+	if expTimeObj.Before(nowObj) {
+		// Token has expired
+		expiredDuration := nowObj.Sub(expTimeObj)
+
+		t.logger.Debugf("Token expired %v ago, grace period is %v",
+			expiredDuration, t.refreshGracePeriod)
+
+		// If we have a refresh token, always attempt to use it regardless of grace period
+		// The refresh token has its own expiry and the provider will reject it if invalid
+		if session.GetRefreshToken() != "" {
+			t.logger.Debugf("Token expired, attempting refresh with available refresh token")
+			return false, true, false // needs refresh
+		}
+
+		// No refresh token available - must re-authenticate
+		t.logger.Debugf("Token expired and no refresh token available, must re-authenticate")
+		return false, false, true // expired, cannot refresh
+	}
+
+	// Token not yet expired - check if nearing expiration
+	refreshThreshold := nowObj.Add(t.refreshGracePeriod)
+
+	t.logger.Debugf("Token expires at %v, now is %v, refresh threshold is %v",
+		expTimeObj.Format(time.RFC3339),
+		nowObj.Format(time.RFC3339),
+		refreshThreshold.Format(time.RFC3339))
+
+	if expTimeObj.Before(refreshThreshold) {
+		remainingSeconds := int64(time.Until(expTimeObj).Seconds())
+		t.logger.Debugf("Token nearing expiration (expires in %d seconds, grace period %s), scheduling proactive refresh",
+			remainingSeconds, t.refreshGracePeriod)
+
+		if session.GetRefreshToken() != "" {
+			return true, true, false
+		}
+
+		t.logger.Debugf("Token nearing expiration but no refresh token available, cannot proactively refresh.")
+		return true, false, false
+	}
+
+	t.logger.Debugf("Token is valid and not nearing expiration (expires in %d seconds, outside %s grace period)",
+		int64(time.Until(expTimeObj).Seconds()), t.refreshGracePeriod)
+
+	return true, false, false
+}
+
+// ============================================================================
+// BACKGROUND TASKS & CLEANUP
+// ============================================================================
+
+// startTokenCleanup starts background cleanup goroutines for cache maintenance.
+// It runs periodic cleanup of token cache, JWK cache, and session chunks.
+// Includes panic recovery to ensure stability.
+func (t *TraefikOidc) startTokenCleanup() {
+	if t == nil {
+		return
+	}
+
+	// Use singleton resource manager for token cleanup
+	rm := GetResourceManager()
+	taskName := "singleton-token-cleanup"
+
+	// Capture values for the cleanup function
+	tokenCache := t.tokenCache
+	jwkCache := t.jwkCache
+	sessionManager := t.sessionManager
+	logger := t.logger
+
+	cleanupInterval := 1 * time.Minute
+	if isTestMode() {
+		cleanupInterval = 50 * time.Millisecond // Fast interval for tests
+	}
+
+	// Create cleanup function
+	cleanupFunc := func() {
+		if logger != nil && !isTestMode() {
+			logger.Debug("Starting token cleanup cycle")
+		}
+		if tokenCache != nil {
+			tokenCache.Cleanup()
+		}
+		if jwkCache != nil {
+			jwkCache.Cleanup()
+		}
+		if sessionManager != nil {
+			sessionManager.PeriodicChunkCleanup()
+			if logger != nil && !isTestMode() {
+				logger.Debug("Running session health monitoring")
+			}
+		}
+	}
+
+	// Register as singleton task - will return existing if already registered
+	err := rm.RegisterBackgroundTask(taskName, cleanupInterval, cleanupFunc)
+	if err != nil {
+		logger.Errorf("Failed to register token cleanup task: %v", err)
+		return
+	}
+
+	// Start the task if not already running
+	if !rm.IsTaskRunning(taskName) {
+		rm.StartBackgroundTask(taskName)
+		logger.Debug("Started singleton token cleanup task")
+	} else {
+		logger.Debug("Token cleanup task already running, skipping duplicate")
+	}
+}
+
+// ============================================================================
+// AUTHORIZATION & ACCESS CONTROL
+// ============================================================================
+
+// extractGroupsAndRoles extracts group and role information from token claims.
+// It parses the 'groups' and 'roles' claims from the ID token and validates their format.
+// Parameters:
+//   - idToken: The ID token containing claims to extract.
+//
+// Returns:
+//   - groups: Array of group names from the 'groups' claim.
+//   - roles: Array of role names from the 'roles' claim.
+//   - An error if claim extraction fails or if the 'groups' or 'roles' claims are present
+//     but not arrays of strings.
+func (t *TraefikOidc) extractGroupsAndRoles(idToken string) ([]string, []string, error) {
+	claims, err := t.extractClaimsFunc(idToken)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to extract claims: %w", err)
+	}
+
+	var groups []string
+	var roles []string
+
+	if groupsClaim, exists := claims["groups"]; exists {
+		groupsSlice, ok := groupsClaim.([]interface{})
+		if !ok {
+			return nil, nil, fmt.Errorf("groups claim is not an array")
+		} else {
+			for _, group := range groupsSlice {
+				if groupStr, ok := group.(string); ok {
+					t.logger.Debugf("Found group: %s", groupStr)
+					groups = append(groups, groupStr)
+				} else {
+					t.logger.Errorf("Non-string value found in groups claim array: %v", group)
+				}
+			}
+		}
+	}
+
+	if rolesClaim, exists := claims["roles"]; exists {
+		rolesSlice, ok := rolesClaim.([]interface{})
+		if !ok {
+			return nil, nil, fmt.Errorf("roles claim is not an array")
+		} else {
+			for _, role := range rolesSlice {
+				if roleStr, ok := role.(string); ok {
+					t.logger.Debugf("Found role: %s", roleStr)
+					roles = append(roles, roleStr)
+				} else {
+					t.logger.Errorf("Non-string value found in roles claim array: %v", role)
+				}
+			}
+		}
+	}
+
+	return groups, roles, nil
+}

token_resilience.go

@@ -220,7 +220,7 @@ func (trm *TokenResilienceManager) Reset() {
 	}
 
 	if trm.logger != nil {
-		trm.logger.Infof("Token resilience manager has been reset")
+		trm.logger.Debugf("Token resilience manager has been reset")
 	}
 }
 

token_validator.go

@@ -1,11 +1,13 @@
 package traefikoidc
 
 import (
+	"bytes"
 	"encoding/base64"
-	"encoding/json"
 	"fmt"
 	"strings"
 	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/pool"
 )
 
 // TokenValidator provides unified token validation functionality
@@ -93,7 +95,10 @@ func (v *TokenValidator) validateJWT(token string) TokenValidationResult {
 	}
 
 	var claims map[string]interface{}
-	if err := json.Unmarshal(payload, &claims); err != nil {
+	pm := pool.Get()
+	decoder := pm.GetJSONDecoder(bytes.NewReader(payload))
+	defer pm.PutJSONDecoder(decoder)
+	if err := decoder.Decode(&claims); err != nil {
 		result.Error = fmt.Errorf("failed to parse JWT claims: %w", err)
 		return result
 	}
@@ -233,7 +238,10 @@ func (v *TokenValidator) ExtractClaims(token string) (map[string]interface{}, er
 	}
 
 	var claims map[string]interface{}
-	if err := json.Unmarshal(payload, &claims); err != nil {
+	pm := pool.Get()
+	decoder := pm.GetJSONDecoder(bytes.NewReader(payload))
+	defer pm.PutJSONDecoder(decoder)
+	if err := decoder.Decode(&claims); err != nil {
 		return nil, fmt.Errorf("failed to parse claims: %w", err)
 	}
 

universal_cache.go

@@ -431,13 +431,13 @@ func (c *UniversalCache) Close() error {
 		// Cleanup routine finished normally
 	case <-time.After(2 * time.Second):
 		// Timeout waiting for cleanup routine
-		c.logger.Info("UniversalCache[%s]: Timeout waiting for cleanup routine", c.config.Type)
+		c.logger.Debug("UniversalCache[%s]: Timeout waiting for cleanup routine", c.config.Type)
 	}
 
 	// Clear all items
 	c.Clear()
 
-	c.logger.Infof("UniversalCache[%s]: Closed", c.config.Type)
+	c.logger.Debugf("UniversalCache[%s]: Closed", c.config.Type)
 	return nil
 }
 

url_helpers.go

@@ -0,0 +1,315 @@
+// Package traefikoidc provides OIDC authentication middleware for Traefik.
+// This file contains URL-related helper methods for building, validating, and processing URLs
+// used in the OIDC authentication flow.
+package traefikoidc
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+// =============================================================================
+// URL Exclusion Methods
+// =============================================================================
+
+// determineExcludedURL checks if a URL path should bypass OIDC authentication.
+// It compares the request path against configured excluded URL prefixes.
+// Parameters:
+//   - currentRequest: The request path to check.
+//
+// Returns:
+//   - true if the URL should be excluded from authentication, false otherwise.
+func (t *TraefikOidc) determineExcludedURL(currentRequest string) bool {
+	for excludedURL := range t.excludedURLs {
+		if strings.HasPrefix(currentRequest, excludedURL) {
+			t.logger.Debugf("URL is excluded - got %s / excluded hit: %s", currentRequest, excludedURL)
+			return true
+		}
+	}
+	return false
+}
+
+// =============================================================================
+// Request Analysis Methods
+// =============================================================================
+
+// determineScheme determines the URL scheme for building redirect URLs.
+// It checks X-Forwarded-Proto header first, then TLS presence.
+// Parameters:
+//   - req: The HTTP request to analyze.
+//
+// Returns:
+//   - The determined scheme: "https" or "http".
+func (t *TraefikOidc) determineScheme(req *http.Request) string {
+	if scheme := req.Header.Get("X-Forwarded-Proto"); scheme != "" {
+		return scheme
+	}
+	if req.TLS != nil {
+		return "https"
+	}
+	return "http"
+}
+
+// determineHost determines the host for building redirect URLs.
+// It checks X-Forwarded-Host header first, then falls back to req.Host.
+// Parameters:
+//   - req: The HTTP request to analyze.
+//
+// Returns:
+//   - The determined host string (e.g., "example.com:8080").
+func (t *TraefikOidc) determineHost(req *http.Request) string {
+	if host := req.Header.Get("X-Forwarded-Host"); host != "" {
+		return host
+	}
+	return req.Host
+}
+
+// =============================================================================
+// URL Building Methods
+// =============================================================================
+
+// buildAuthURL constructs the OIDC provider authorization URL.
+// It builds the URL with all necessary parameters including client_id, scopes,
+// PKCE parameters, and provider-specific parameters for Google and Azure.
+// Parameters:
+//   - redirectURL: The callback URL for after authentication.
+//   - state: The CSRF token for state validation.
+//   - nonce: The nonce for replay protection.
+//   - codeChallenge: The PKCE code challenge (if PKCE is enabled).
+//
+// Returns:
+//   - The fully constructed authorization URL string.
+func (t *TraefikOidc) buildAuthURL(redirectURL, state, nonce, codeChallenge string) string {
+	params := url.Values{}
+	params.Set("client_id", t.clientID)
+	params.Set("response_type", "code")
+	params.Set("redirect_uri", redirectURL)
+	params.Set("state", state)
+	params.Set("nonce", nonce)
+
+	if t.enablePKCE && codeChallenge != "" {
+		params.Set("code_challenge", codeChallenge)
+		params.Set("code_challenge_method", "S256")
+	}
+
+	scopes := make([]string, len(t.scopes))
+	copy(scopes, t.scopes)
+
+	if t.isGoogleProvider() {
+		params.Set("access_type", "offline")
+		t.logger.Debug("Google OIDC provider detected, added access_type=offline for refresh tokens")
+
+		params.Set("prompt", "consent")
+		t.logger.Debug("Google OIDC provider detected, added prompt=consent to ensure refresh tokens")
+	} else if t.isAzureProvider() {
+		params.Set("response_mode", "query")
+		t.logger.Debug("Azure AD provider detected, added response_mode=query")
+
+		hasOfflineAccess := false
+
+		for _, scope := range scopes {
+			if scope == "offline_access" {
+				hasOfflineAccess = true
+				break
+			}
+		}
+
+		if !t.overrideScopes || (t.overrideScopes && len(t.scopes) == 0) {
+			if !hasOfflineAccess {
+				scopes = append(scopes, "offline_access")
+				t.logger.Debugf("Azure AD provider: Added offline_access scope (overrideScopes: %t, user scopes count: %d)", t.overrideScopes, len(t.scopes))
+			}
+		} else {
+			t.logger.Debugf("Azure AD provider: User is overriding scopes (count: %d), offline_access not automatically added.", len(t.scopes))
+		}
+	} else {
+		if !t.overrideScopes || (t.overrideScopes && len(t.scopes) == 0) {
+			hasOfflineAccess := false
+			for _, scope := range scopes {
+				if scope == "offline_access" {
+					hasOfflineAccess = true
+					break
+				}
+			}
+			if !hasOfflineAccess {
+				scopes = append(scopes, "offline_access")
+				t.logger.Debugf("Standard provider: Added offline_access scope (overrideScopes: %t, user scopes count: %d)", t.overrideScopes, len(t.scopes))
+			}
+		} else {
+			t.logger.Debugf("Standard provider: User is overriding scopes (count: %d), offline_access not automatically added.", len(t.scopes))
+		}
+	}
+
+	if len(scopes) > 0 {
+		finalScopeString := strings.Join(scopes, " ")
+		params.Set("scope", finalScopeString)
+		t.logger.Debugf("TraefikOidc.buildAuthURL: Final scope string being sent to OIDC provider: %s", finalScopeString)
+	}
+
+	return t.buildURLWithParams(t.authURL, params)
+}
+
+// buildURLWithParams constructs a URL by combining a base URL with query parameters.
+// It handles both relative and absolute URLs, validates URL security,
+// and properly encodes query parameters.
+// Parameters:
+//   - baseURL: The base URL to append parameters to.
+//   - params: The query parameters to append.
+//
+// Returns:
+//   - The fully constructed URL string with appended query parameters.
+func (t *TraefikOidc) buildURLWithParams(baseURL string, params url.Values) string {
+	if baseURL != "" {
+		if strings.HasPrefix(baseURL, "http://") || strings.HasPrefix(baseURL, "https://") {
+			if err := t.validateURL(baseURL); err != nil {
+				t.logger.Errorf("URL validation failed for %s: %v", baseURL, err)
+				return ""
+			}
+		}
+	}
+
+	if !strings.HasPrefix(baseURL, "http://") && !strings.HasPrefix(baseURL, "https://") {
+		issuerURLParsed, err := url.Parse(t.issuerURL)
+		if err != nil {
+			t.logger.Errorf("Could not parse issuerURL: %s. Error: %v", t.issuerURL, err)
+			return ""
+		}
+
+		baseURLParsed, err := url.Parse(baseURL)
+		if err != nil {
+			t.logger.Errorf("Could not parse baseURL: %s. Error: %v", baseURL, err)
+			return ""
+		}
+
+		resolvedURL := issuerURLParsed.ResolveReference(baseURLParsed)
+
+		if err := t.validateURL(resolvedURL.String()); err != nil {
+			t.logger.Errorf("Resolved URL validation failed for %s: %v", resolvedURL.String(), err)
+			return ""
+		}
+
+		resolvedURL.RawQuery = params.Encode()
+		return resolvedURL.String()
+	}
+
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		t.logger.Errorf("Could not parse absolute baseURL: %s. Error: %v", baseURL, err)
+		return ""
+	}
+
+	if err := t.validateParsedURL(u); err != nil {
+		t.logger.Errorf("Parsed URL validation failed for %s: %v", baseURL, err)
+		return ""
+	}
+
+	u.RawQuery = params.Encode()
+	return u.String()
+}
+
+// =============================================================================
+// URL Validation Methods
+// =============================================================================
+
+// validateURL performs security validation on URLs to prevent SSRF attacks.
+// It checks for allowed schemes, validates hosts, and prevents access to private networks.
+// Parameters:
+//   - urlStr: The URL string to validate.
+//
+// Returns:
+//   - An error if the URL is invalid or poses security risks, nil if valid.
+func (t *TraefikOidc) validateURL(urlStr string) error {
+	if urlStr == "" {
+		return fmt.Errorf("empty URL")
+	}
+
+	u, err := url.Parse(urlStr)
+	if err != nil {
+		return fmt.Errorf("invalid URL format: %w", err)
+	}
+
+	return t.validateParsedURL(u)
+}
+
+// validateParsedURL validates a parsed URL structure for security.
+// It checks schemes, hosts, and paths to prevent malicious URLs.
+// Parameters:
+//   - u: The parsed URL to validate.
+//
+// Returns:
+//   - An error if the URL is invalid or dangerous, nil if safe.
+func (t *TraefikOidc) validateParsedURL(u *url.URL) error {
+	allowedSchemes := map[string]bool{
+		"https": true,
+		"http":  true,
+	}
+
+	if !allowedSchemes[u.Scheme] {
+		return fmt.Errorf("disallowed URL scheme: %s", u.Scheme)
+	}
+
+	if u.Scheme == "http" {
+		t.logger.Debugf("Warning: Using HTTP scheme for URL: %s", u.String())
+	}
+
+	if u.Host == "" {
+		return fmt.Errorf("missing host in URL")
+	}
+
+	if err := t.validateHost(u.Host); err != nil {
+		return fmt.Errorf("invalid host: %w", err)
+	}
+
+	if strings.Contains(u.Path, "..") {
+		return fmt.Errorf("path traversal detected in URL path")
+	}
+
+	return nil
+}
+
+// validateHost validates a hostname or IP address for security.
+// It prevents access to localhost, private networks, and known metadata endpoints.
+// Parameters:
+//   - host: The host string to validate (may include port).
+//
+// Returns:
+//   - An error if the host is dangerous or not allowed, nil if safe.
+func (t *TraefikOidc) validateHost(host string) error {
+	hostname := host
+	if strings.Contains(host, ":") {
+		var err error
+		hostname, _, err = net.SplitHostPort(host)
+		if err != nil {
+			return fmt.Errorf("invalid host format: %w", err)
+		}
+	}
+
+	ip := net.ParseIP(hostname)
+	if ip != nil {
+		if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
+			return fmt.Errorf("access to private/internal IP addresses is not allowed: %s", ip.String())
+		}
+
+		if ip.IsUnspecified() || ip.IsMulticast() {
+			return fmt.Errorf("access to unspecified or multicast IP addresses is not allowed: %s", ip.String())
+		}
+	}
+
+	dangerousHosts := map[string]bool{
+		"localhost":                true,
+		"127.0.0.1":                true,
+		"::1":                      true,
+		"0.0.0.0":                  true,
+		"169.254.169.254":          true,
+		"metadata.google.internal": true,
+	}
+
+	if dangerousHosts[strings.ToLower(hostname)] {
+		return fmt.Errorf("access to dangerous hostname is not allowed: %s", hostname)
+	}
+
+	return nil
+}

utilities.go

@@ -0,0 +1,299 @@
+// Package traefikoidc provides OIDC authentication middleware for Traefik.
+// This file contains utility/helper methods extracted from main.go for better code organization.
+package traefikoidc
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"runtime"
+	"strings"
+	"time"
+)
+
+// =============================================================================
+// LOGGING UTILITIES
+// =============================================================================
+
+// safeLogDebug provides nil-safe logging for debug messages
+func (t *TraefikOidc) safeLogDebug(msg string) {
+	if t.logger != nil {
+		t.logger.Debug("%s", msg)
+	}
+}
+
+// safeLogDebugf provides nil-safe logging for formatted debug messages
+func (t *TraefikOidc) safeLogDebugf(format string, args ...interface{}) {
+	if t.logger != nil {
+		t.logger.Debugf(format, args...)
+	}
+}
+
+// safeLogError provides nil-safe logging for error messages
+func (t *TraefikOidc) safeLogError(msg string) {
+	if t.logger != nil {
+		t.logger.Error("%s", msg)
+	}
+}
+
+// safeLogErrorf provides nil-safe logging for formatted error messages
+func (t *TraefikOidc) safeLogErrorf(format string, args ...interface{}) {
+	if t.logger != nil {
+		t.logger.Errorf(format, args...)
+	}
+}
+
+// safeLogInfo provides nil-safe logging for info messages
+func (t *TraefikOidc) safeLogInfo(msg string) {
+	if t.logger != nil {
+		t.logger.Info("%s", msg)
+	}
+}
+
+// =============================================================================
+// DOMAIN VALIDATION
+// =============================================================================
+
+// isAllowedDomain checks if an email address is authorized based on domain or user whitelist.
+// It validates against both allowed user domains and specific allowed users.
+// Parameters:
+//   - email: The email address to validate.
+//
+// Returns:
+//   - true if the email is authorized (domain or user allowed), false if not authorized
+//     or if the email format is invalid.
+func (t *TraefikOidc) isAllowedDomain(email string) bool {
+	if len(t.allowedUserDomains) == 0 && len(t.allowedUsers) == 0 {
+		return true
+	}
+
+	if len(t.allowedUsers) > 0 {
+		_, userAllowed := t.allowedUsers[strings.ToLower(email)]
+		if userAllowed {
+			t.logger.Debugf("Email %s is explicitly allowed in allowedUsers", email)
+			return true
+		}
+	}
+
+	if len(t.allowedUserDomains) > 0 {
+		parts := strings.Split(email, "@")
+		if len(parts) != 2 {
+			t.logger.Errorf("Invalid email format encountered: %s", email)
+			return false
+		}
+
+		domain := parts[1]
+		_, domainAllowed := t.allowedUserDomains[domain]
+
+		if domainAllowed {
+			t.logger.Debugf("Email domain %s is allowed", domain)
+			return true
+		} else {
+			t.logger.Debugf("Email domain %s is NOT allowed. Allowed domains: %v",
+				domain, keysFromMap(t.allowedUserDomains))
+		}
+	} else if len(t.allowedUsers) > 0 {
+		t.logger.Debugf("Email %s is not in the allowed users list: %v",
+			email, keysFromMap(t.allowedUsers))
+	}
+
+	return false
+}
+
+// keysFromMap extracts string keys from a map for logging purposes.
+// Helper function to get keys from a map for logging.
+// Parameters:
+//   - m: The map to extract keys from.
+//
+// Returns:
+//   - A slice of string keys.
+func keysFromMap(m map[string]struct{}) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	return keys
+}
+
+// =============================================================================
+// ERROR HANDLING
+// =============================================================================
+
+// sendErrorResponse sends an appropriate error response based on the request's Accept header.
+// It sends JSON responses for clients that accept JSON, otherwise sends HTML error pages.
+// Parameters:
+//   - rw: The HTTP response writer.
+//   - req: The HTTP request (used to check Accept header).
+//   - message: The error message to display.
+//   - code: The HTTP status code to set for the response.
+func (t *TraefikOidc) sendErrorResponse(rw http.ResponseWriter, req *http.Request, message string, code int) {
+	acceptHeader := req.Header.Get("Accept")
+
+	if strings.Contains(acceptHeader, "application/json") {
+		t.logger.Debugf("Sending JSON error response (code %d): %s", code, message)
+		rw.Header().Set("Content-Type", "application/json")
+		rw.WriteHeader(code)
+		json.NewEncoder(rw).Encode(map[string]interface{}{
+			"error":             http.StatusText(code),
+			"error_description": message,
+			"status_code":       code,
+		})
+		return
+	}
+
+	t.logger.Debugf("Sending HTML error response (code %d): %s", code, message)
+
+	returnURL := "/"
+
+	htmlBody := fmt.Sprintf(`
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Authentication Error</title>
+    <style>
+        body { font-family: sans-serif; padding: 20px; background-color: #f8f9fa; color: #343a40; }
+        h1 { color: #dc3545; }
+        a { color: #007bff; text-decoration: none; }
+        a:hover { text-decoration: underline; }
+        .container { max-width: 600px; margin: auto; background: #fff; padding: 20px; border-radius: 5px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>Authentication Error</h1>
+        <p>%s</p>
+        <p><a href="%s">Return to application</a></p>
+    </div>
+</body>
+</html>`, message, returnURL)
+
+	rw.Header().Set("Content-Type", "text/html; charset=utf-8")
+	rw.WriteHeader(code)
+	_, _ = rw.Write([]byte(htmlBody))
+}
+
+// =============================================================================
+// CLEANUP
+// =============================================================================
+
+// Close gracefully shuts down the TraefikOidc middleware instance.
+// It cancels contexts, stops background goroutines, closes HTTP connections,
+// cleans up caches, and releases all resources. Safe to call multiple times.
+// Returns:
+//   - An error if shutdown times out or resource cleanup fails.
+func (t *TraefikOidc) Close() error {
+	var closeErr error
+	t.shutdownOnce.Do(func() {
+		t.safeLogDebug("Closing TraefikOidc plugin instance")
+
+		// Get resource manager for cleanup
+		rm := GetResourceManager()
+
+		// Stop singleton tasks related to this instance
+		rm.StopBackgroundTask("singleton-token-cleanup")
+		rm.StopBackgroundTask("singleton-metadata-refresh")
+
+		// Remove reference for this instance
+		rm.RemoveReference(t.name)
+
+		if t.cancelFunc != nil {
+			t.cancelFunc()
+			t.safeLogDebug("Context cancellation signaled to all goroutines")
+		}
+
+		// Clean up legacy stop channels if they exist
+		if t.tokenCleanupStopChan != nil {
+			close(t.tokenCleanupStopChan)
+			t.safeLogDebug("tokenCleanupStopChan closed")
+		}
+		if t.metadataRefreshStopChan != nil {
+			close(t.metadataRefreshStopChan)
+			t.safeLogDebug("metadataRefreshStopChan closed")
+		}
+
+		if t.goroutineWG != nil {
+			done := make(chan struct{})
+			go func() {
+				t.goroutineWG.Wait()
+				close(done)
+			}()
+
+			select {
+			case <-done:
+				t.safeLogDebug("All background goroutines stopped gracefully")
+			case <-time.After(10 * time.Second):
+				t.safeLogError("Timeout waiting for background goroutines to stop")
+			}
+		} else {
+			t.safeLogDebug("No goroutineWG to wait for (likely in test)")
+		}
+
+		if t.httpClient != nil {
+			if transport, ok := t.httpClient.Transport.(*http.Transport); ok {
+				transport.CloseIdleConnections()
+				t.safeLogDebug("HTTP client idle connections closed")
+			}
+		}
+
+		if t.tokenHTTPClient != nil {
+			if transport, ok := t.tokenHTTPClient.Transport.(*http.Transport); ok {
+				transport.CloseIdleConnections()
+				t.safeLogDebug("Token HTTP client idle connections closed")
+			}
+			if t.tokenHTTPClient.Transport != t.httpClient.Transport {
+				if transport, ok := t.tokenHTTPClient.Transport.(*http.Transport); ok {
+					transport.CloseIdleConnections()
+					t.safeLogDebug("Token HTTP client transport closed (separate from main)")
+				}
+			}
+		}
+
+		if t.tokenBlacklist != nil {
+			t.tokenBlacklist.Close()
+			t.safeLogDebug("tokenBlacklist closed")
+		}
+		if t.metadataCache != nil {
+			t.metadataCache.Close()
+			t.safeLogDebug("metadataCache closed")
+		}
+		if t.tokenCache != nil {
+			t.tokenCache.Close()
+			t.safeLogDebug("tokenCache closed")
+		}
+
+		if t.jwkCache != nil {
+			t.jwkCache.Close()
+			t.safeLogDebug("t.jwkCache.Close() called as per original instruction.")
+		}
+
+		// Shutdown session manager and its background cleanup routines
+		if t.sessionManager != nil {
+			if err := t.sessionManager.Shutdown(); err != nil {
+				t.safeLogErrorf("Error shutting down session manager: %v", err)
+			} else {
+				t.safeLogDebug("sessionManager shutdown completed")
+			}
+		}
+
+		// Clean up error recovery manager
+		if t.errorRecoveryManager != nil && t.errorRecoveryManager.gracefulDegradation != nil {
+			t.errorRecoveryManager.gracefulDegradation.Close()
+			t.safeLogDebug("Error recovery manager graceful degradation closed")
+		}
+
+		// Stop all global background tasks
+		taskRegistry := GetGlobalTaskRegistry()
+		taskRegistry.StopAllTasks()
+		t.safeLogDebug("All global background tasks stopped")
+
+		// Note: Centralized pool in internal/pool is singleton-managed and doesn't require explicit cleanup
+		t.safeLogDebug("Memory pools managed by singleton pattern")
+
+		// Force garbage collection to help with memory cleanup after shutdown
+		runtime.GC()
+		t.safeLogDebug("Forced garbage collection after shutdown")
+
+		t.safeLogDebug("TraefikOidc plugin instance closed successfully.")
+	})
+	return closeErr
+}