Repository navigation

fix!: harden JWKS rotation, typ, issuer/redirect URL and Client-Cert parsing, kid-less client keys - #777

Merged

osanderson merged 7 commits into

mainfrom

fix/keys-urls-hardening

Nov 2, 2026

Merged

fix!: harden JWKS rotation, typ, issuer/redirect URL and Client-Cert parsing, kid-less client keys#777
osanderson merged 7 commits into
mainfrom
fix/keys-urls-hardening

Commits on Nov 2, 2026
- fix(keys): let an unknown kid force a JWKS refetch with the default options
  
  osanderson
  and
  claude
  committed
  99aff1d
- fix(jose): compare a JWT typ case-insensitively in ASCII only
  
  osanderson
  and
  claude
  committed
  191824d
- fix(server,client)!: refuse a configured issuer with a query
  
  osanderson
  and
  claude
  committed
  de97ac3
- fix!: refuse an empty fragment in issuer, endpoint and redirect URIs
  
  osanderson
  and
  claude
  committed
  f3a006b
- fix(fapihttp): accept Structured Field parameters on a forwarded Client-Cert
  
  osanderson
  and
  claude
  committed
  4555c67
- fix(keys): match a kid-less client key by its RFC 7638 thumbprint
  
  osanderson
  and
  claude
  committed
  da49bdf
- test(fapihttp): cover each refused Client-Cert parameter value
  
  osanderson
  and
  claude
  committed
  bce8360