raucao
295261b332
CI / Test (pull_request) Failing after 46s
- Make authorization-code redemption atomic: claim the code with a guarded delete inside the transaction that creates the authorization, so concurrent exchanges can't both issue a token (RFC 6749 4.1.3) - Compare the token request's client_id host to the code's stored client_id (defense-in-depth alongside the exact redirect_uri match) - Reject unknown response_type values with unsupported_response_type - Validate the PKCE code_challenge (43-128 unreserved chars, S256) so a client can't persist an over-long or malformed challenge - Return invalid_request for missing token-endpoint parameters, and set Cache-Control: no-store on error responses too - Use the right separator when the redirect_uri already has a query string - Look codes up through the active scope; drop the unused consume!; serialize permissions as JSON - Purge abandoned authorization codes via a recurring Solid Queue task Part of #254
16 lines
440 B
YAML
16 lines
440 B
YAML
# production:
|
|
# periodic_cleanup:
|
|
# class: CleanSoftDeletedRecordsJob
|
|
# queue: background
|
|
# args: [ 1000, { batch_size: 500 } ]
|
|
# schedule: every hour
|
|
# periodic_command:
|
|
# command: "SoftDeletedRecord.due.delete_all"
|
|
# priority: 2
|
|
# schedule: at 5am every day
|
|
|
|
production:
|
|
purge_rs_authorization_codes:
|
|
command: "RsAuthorizationCode.where(expires_at: ..1.hour.ago).delete_all"
|
|
schedule: every hour
|