Follow-up from the #10 security review.
nova_auth_oidc_jwt:validate_token/3 now calls oidcc_jwt_util:verify_signature/3, which is marked ?DOC(false) in oidcc - internal, outside oidcc's semver contract. rebar.config pins {oidcc, "~> 3.7"}, so any 3.x bump could change or remove this function's behavior without it counting as a breaking change from oidcc's side. xref (undefined_function_calls, already enabled) would catch outright removal at CI, but a silent semantic change (e.g. to the kid-selection fold) would ship unnoticed - which is exactly the class of bug #9/#10 fixed.
oidcc's public equivalent is oidcc_token:validate_jwt/3 (exported, documented), which does signature + iss + aud (via trusted_audiences) + exp in the future + nbf in the past + JWE decrypt in one call, with a caller-supplied signing_algs list. It needs an oidcc_client_context built via oidcc_client_context:from_configuration_worker/4, which this library already has everything needed to construct.
Migrating would also fold in nbf validation for free (not currently checked - a token with nbf set in the future is currently accepted) and give the audience/algorithm checks first-party support instead of nova_auth_oidc reimplementing them.
Not urgent - the current call is the minimal correct fix for #9 - but worth doing before oidcc's next major version, and would reduce the surface this library reimplements against a moving internal target.
Follow-up from the #10 security review.
nova_auth_oidc_jwt:validate_token/3now callsoidcc_jwt_util:verify_signature/3, which is marked?DOC(false)in oidcc - internal, outside oidcc's semver contract.rebar.configpins{oidcc, "~> 3.7"}, so any 3.x bump could change or remove this function's behavior without it counting as a breaking change from oidcc's side.xref(undefined_function_calls, already enabled) would catch outright removal at CI, but a silent semantic change (e.g. to the kid-selection fold) would ship unnoticed - which is exactly the class of bug #9/#10 fixed.oidcc's public equivalent is
oidcc_token:validate_jwt/3(exported, documented), which does signature +iss+aud(viatrusted_audiences) +expin the future +nbfin the past + JWE decrypt in one call, with a caller-suppliedsigning_algslist. It needs anoidcc_client_contextbuilt viaoidcc_client_context:from_configuration_worker/4, which this library already has everything needed to construct.Migrating would also fold in
nbfvalidation for free (not currently checked - a token withnbfset in the future is currently accepted) and give the audience/algorithm checks first-party support instead of nova_auth_oidc reimplementing them.Not urgent - the current call is the minimal correct fix for #9 - but worth doing before oidcc's next major version, and would reduce the surface this library reimplements against a moving internal target.