omniauth_oidc 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cce0adf88c627aec578c583501b037291603060f20738e6556aa4cdb99113012
-  data.tar.gz: 4c1342ba1adf61d390e2b52dd41f82bc6a949d32f872427a6451f6b97de55204
+  metadata.gz: e94e09a2103532e642e008b239bf772fab6a609e9a9fcde6b943687b89ee25d9
+  data.tar.gz: e22f3910b293c1e4fcf9ea3746a27bf8258764b697acd2dd3fe7bce8425cb16c
 SHA512:
-  metadata.gz: 016d2b5695b3423cb2e91f5319b0dbf616ebc0dde2ea057a38e72eeb52a51191b62ec3d2b8d65394291fcb2a4e2d232a321b81e0fb8a9c0f1e59ffcce09509c6
-  data.tar.gz: 3a6bd0338037be812a0547967e8e292b795ed4c4ad5a846f2b1a17a54e54703aced331a2a45280f28579da5c5a0139e098e300ddbaa3e822fdd2cc235eba9796
+  metadata.gz: 0a26fcaae36be1ba4f3f5b0f69e97e5528e0dd041fe29add4bbcede7b84ddf8377222c9a3dc7c8af6da53218a7acbb1e0183e816cc848b974247fc82e3c2e4dc
+  data.tar.gz: 3c1cbe6e6ce3c57b028c59346614719424693b894d018eccb8708d6e2ec621ef63870571a40b96cf487e26da1fb1c3afc3f5578329155e6832fdd4518fe79613

data/CHANGELOG.md

@@ -1,5 +1,46 @@
 ## [Released]
 
+## [1.1.0] - 2026-10-14
+
+### Security
+- **ID token algorithm no longer taken from the token header**: Previously, with `client_signing_alg` unset (the default), the gem verified an ID token with whatever algorithm its own header named. An unsigned `alg: none` token was accepted, which allowed forging a login for any `sub` in the `response_type: "id_token"` flow. Accepted algorithms now come from `client_signing_alg`, otherwise the discovery document's `id_token_signing_alg_values_supported`, otherwise `RS256`. `none` is always rejected. Raises `OmniauthOidc::InvalidAlgorithmError`.
+- **Empty HMAC secret refused**: A `jwt_secret_base64` that decodes to an empty string is rejected with `OmniauthOidc::ConfigurationError` instead of being used as the HS256/384/512 key (CVE-2026-45363).
+- **jwt dependency**: Now requires `jwt >= 2.10.3` and excludes 3.0.0 to 3.1.2, the releases affected by CVE-2026-45363.
+- **Nonce read from session only**: The expected nonce is no longer taken from the callback's request params, which the caller controls. It now comes only from the value stored in the session during the request phase. This also removes a call to ActiveSupport's `presence`, which raised `NoMethodError` in non-Rails apps.
+- **Nonce required when one was sent**: With `send_nonce: true` (the default), a callback whose session holds no nonce now fails with `OmniauthOidc::InvalidNonceError` instead of skipping the check. The `response_type: "id_token"` flow always sends and requires a nonce, as OIDC Core 3.2.2.1 requires. The nonce is consumed before any other claim check, so it stays single use even when verification fails, and its value is no longer written to error messages.
+- **PKCE verifier read from session only**: The `code_verifier` is no longer taken from callback request params. With PKCE on, a callback whose session holds no verifier fails with `OmniauthOidc::TokenError`.
+- **Issuer check cannot be skipped**: A discovery document with a missing or `null` `issuer` previously disabled the `iss` check (or crashed with `NoMethodError`). Discovery documents without `issuer` or `authorization_endpoint` are now rejected with `OmniauthOidc::ConfigurationError`.
+- **`exp` claim required**: ID tokens without an `exp` claim, or with a non-numeric one, are now rejected with `OmniauthOidc::TokenVerificationError`, as OIDC Core 3.1.3.7 requires.
+- **UserInfo `sub` must match the ID token**: A UserInfo response whose `sub` differs from the ID token's is ignored, and the login uses the ID token claims only (OIDC Core 5.3.4).
+- **Login without a subject fails**: A callback that cannot determine a `sub` now fails with `OmniauthOidc::TokenVerificationError` instead of completing with a `nil` uid.
+- **Safer HTTP redirects**: Redirects from HTTPS to HTTP are refused, and the `Authorization` header is dropped when a redirect leaves the original host, so a UserInfo access token cannot leak to another host or over cleartext.
+
+### Changed
+- **PKCE is enabled by default** (`pkce: true`). Authorization servers that do not support PKCE ignore the extra parameters (RFC 6749 3.1). Set `pkce: false` to opt out.
+- **Discovery document cached across requests**: OmniAuth copies the strategy for every request, so the discovery document was fetched on every request and callback. It is now cached per process for `discovery_cache_ttl` seconds (default `3600`, `0` disables). Failed fetches are not cached.
+- **Concurrent cache access**: The JWKS cache no longer holds a global lock during network fetches. A slow JWKS endpoint for one provider no longer blocks cache hits for every other provider, and concurrent misses for the same URI trigger a single fetch.
+- **HTTP timeouts**: Requests to the provider now time out after 5 seconds to connect and 10 seconds to read, instead of the 60 second `Net::HTTP` defaults.
+- **Fewer signature checks**: The ID token is verified once per callback and the result is reused, instead of being decoded and verified up to three times.
+- **Configuration and JWKS errors no longer return 500**: `OmniauthOidc::ConfigurationError` and `OmniauthOidc::JwksError` raised during the request or callback phase are passed to OmniAuth's failure handler with the `configuration_error` or `jwks_error` key.
+
+### Added
+- **`clock_skew_leeway` option** (default `60` seconds): Tolerates clock drift between the app and the provider when checking the ID token `exp` and `nbf` claims. Set to `0` for the previous strict behavior. Values other than a non-negative Integer raise `OmniauthOidc::ConfigurationError`.
+- **`discovery_cache_ttl` option** (default `3600` seconds).
+
+### Fixed
+- **`jwks_cache_ttl` was ignored**: The option is now applied to the JWKS cache.
+- **Signing key rotation**: An ID token whose `kid` is not in the cached JWKS now triggers a JWKS refresh, rate limited to once per minute per JWKS URI. Previously the refresh path never ran, and logins failed until the cache expired.
+- **Missing `code` or `id_token` in the callback**: The failure response is now returned immediately, instead of being discarded while the callback continued to the token endpoint.
+- **Discovery documents without optional fields**: A missing `userinfo_endpoint`, `end_session_endpoint` or `scopes_supported` no longer raises `NoMethodError`.
+
+### Deprecated
+- **`uid_field` option**: It has never had an effect. The uid has always been the `sub` claim, the only identifier OIDC guarantees to be stable and unique per issuer, and that does not change. Setting `uid_field` to anything other than `"sub"` now logs a deprecation warning. The option will be removed in 2.0.0.
+
+### Upgrade notes
+- Logins that are in progress during the upgrade (request phase on 1.0.x, callback on 1.1.0) fail once, because the session holds no PKCE verifier. Users can simply sign in again.
+- Apps that set `require_state: false` to accept IdP-initiated logins also need `send_nonce: false`, since no nonce is stored for a login the app did not start.
+- If a provider signs ID tokens with an algorithm it does not advertise in its discovery document, set `client_signing_alg` explicitly.
+
 ## [1.0.1] - 2026-03-23
 
 - Update jwt dependency

data/README.md

@@ -2,7 +2,7 @@
 
 OmniAuth strategy for OpenID Connect (OIDC) authentication. Supports multiple OIDC providers, PKCE, JWKS key rotation, and both `code` and `id_token` response types.
 
-Minimal dependencies: only `omniauth` and `jwt` gems required. All HTTP requests use Ruby's built-in `Net::HTTP` — no Faraday, HTTParty, or other external HTTP clients.
+Minimal dependencies: only `omniauth` and `jwt` gems required. All HTTP requests use Ruby's built-in `Net::HTTP`, with no Faraday, HTTParty, or other external HTTP clients.
 
 Developed with reference to [omniauth-openid-connect](https://github.com/jjbohn/omniauth-openid-connect) and [omniauth_openid_connect](https://github.dev/omniauth/omniauth_openid_connect).
 
@@ -50,7 +50,6 @@ Devise.setup do |config|
     name: :simple_provider,
     scope: %w[openid email profile address],
     response_type: :code,
-    uid_field: "preferred_username",
     client_options: {
       identifier: '23575f4602bebbd9a17dbc38d85bd1a77',
       secret: ENV['SIMPLE_PROVIDER_CLIENT_SECRET'],
@@ -73,10 +72,11 @@ Rails.application.config.middleware.use OmniAuth::Builder do
     require_state: true,
     response_mode: :query,
     prompt: :login,
-    send_nonce: false,
-    uid_field: "sub",
-    pkce: false,
+    send_nonce: true, # always on for response_type 'id_token'
+    pkce: true, # default since 1.1.0
     jwks_cache_ttl: 3600, # JWKS cache TTL in seconds (default: 3600)
+    discovery_cache_ttl: 3600, # Discovery document cache TTL in seconds (default: 3600)
+    clock_skew_leeway: 60, # Allowed clock drift in seconds for exp/nbf (default: 60)
     client_options: {
       identifier: '23575f4602bebbd9a17dbc38d85bd1a77',
       secret: ENV['COMPLEX_PROVIDER_CLIENT_SECRET'],
@@ -271,13 +271,13 @@ OmniauthOidc::Logging.logger = Rails.logger
 
 If ActiveSupport::Notifications is available (e.g. in Rails), the gem publishes instrumentation events:
 
-- `config.fetch.omniauth_oidc` — OIDC discovery document fetch
-- `token.exchange.omniauth_oidc` — authorization code to token exchange
-- `userinfo.fetch.omniauth_oidc` — userinfo endpoint call
-- `jwks.fetch.omniauth_oidc` — JWKS fetch
-- `request_phase.start.omniauth_oidc` — authorization redirect
-- `callback_phase.start.omniauth_oidc` — callback processing
-- `id_token.verify.omniauth_oidc` — ID token verification
+- `config.fetch.omniauth_oidc`: OIDC discovery document fetch
+- `token.exchange.omniauth_oidc`: authorization code to token exchange
+- `userinfo.fetch.omniauth_oidc`: userinfo endpoint call
+- `jwks.fetch.omniauth_oidc`: JWKS fetch
+- `request_phase.start.omniauth_oidc`: authorization redirect
+- `callback_phase.start.omniauth_oidc`: callback processing
+- `id_token.verify.omniauth_oidc`: ID token verification
 
 ### Error Handling
 
@@ -286,19 +286,43 @@ The gem raises specific error classes that you can rescue in your callback handl
 | Error Class | When Raised |
 |---|---|
 | `OmniauthOidc::MissingConfigurationError` | Required options (`identifier`, `secret`, `config_endpoint`) are missing |
-| `OmniauthOidc::ConfigurationError` | OIDC discovery endpoint fetch fails |
-| `OmniauthOidc::TokenError` | Token exchange fails |
-| `OmniauthOidc::TokenVerificationError` | JWT format is invalid |
-| `OmniauthOidc::TokenExpiredError` | ID token `exp` claim is in the past |
-| `OmniauthOidc::InvalidAlgorithmError` | JWT algorithm does not match `client_signing_alg` |
+| `OmniauthOidc::ConfigurationError` | OIDC discovery endpoint fetch fails, the discovery document has no `issuer` or `authorization_endpoint`, or an option is invalid (negative `clock_skew_leeway`, empty HMAC secret) |
+| `OmniauthOidc::TokenError` | Token exchange fails, or PKCE is enabled and no code verifier is stored in the session |
+| `OmniauthOidc::TokenVerificationError` | JWT format is invalid, the ID token has no numeric `exp` claim, or no subject (`sub`) could be determined |
+| `OmniauthOidc::TokenExpiredError` | ID token `exp` claim is in the past, beyond `clock_skew_leeway` |
+| `OmniauthOidc::InvalidAlgorithmError` | JWT algorithm is not accepted (see [Security Defaults](#security-defaults)) |
 | `OmniauthOidc::InvalidSignatureError` | JWT signature verification fails |
 | `OmniauthOidc::InvalidIssuerError` | ID token `iss` does not match expected issuer |
 | `OmniauthOidc::InvalidAudienceError` | ID token `aud` does not match client identifier |
-| `OmniauthOidc::InvalidNonceError` | ID token `nonce` does not match stored nonce |
+| `OmniauthOidc::InvalidNonceError` | ID token `nonce` does not match the stored nonce, or no nonce is stored when one is required |
 | `OmniauthOidc::JwksFetchError` | JWKS endpoint fetch fails |
 
 All error classes inherit from `OmniauthOidc::Error < RuntimeError`.
 
+During the request and callback phases these errors do not propagate as exceptions. They are passed to OmniAuth's
+failure handler, which by default redirects to `/auth/failure?message=<key>` with one of these keys: `csrf_detected`,
+`missing_code`, `missing_id_token`, `token_error`, `http_error`, `timeout`, `failed_to_connect`, `configuration_error`
+or `jwks_error`. The exception itself is available in `request.env['omniauth.error']`.
+
+### Security Defaults
+
+The gem verifies every ID token as required by [OIDC Core 3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation):
+
+- **Signature and algorithm**: the accepted algorithms come from configuration, never from the token header. They are
+  `client_signing_alg` when set, otherwise the provider's `id_token_signing_alg_values_supported`, otherwise `RS256`.
+  Unsigned (`alg: none`) tokens are always rejected, and an empty HMAC secret is refused.
+- **Claims**: `iss` must equal the discovery `issuer`, `aud` must contain the client `identifier`, `exp` is required,
+  and `exp`/`nbf` allow `clock_skew_leeway` seconds of drift.
+- **Nonce**: generated per login and stored in the session. It is required when `send_nonce` is on (the default) and
+  always for `response_type: 'id_token'`. It is never read from request parameters.
+- **PKCE**: on by default. The code verifier is read only from the session.
+- **UserInfo**: the response is used only when its `sub` matches the ID token `sub` (OIDC Core 5.3.4).
+- **HTTP**: requests time out after 5s (connect) and 10s (read). Redirects never downgrade from HTTPS to HTTP, and the
+  `Authorization` header is dropped when a redirect leaves the original host.
+- **Caching**: the discovery document and JWKS are cached per process. An ID token with an unknown `kid` triggers at
+  most one JWKS refresh per minute, so signing key rotation is picked up without letting forged tokens flood the
+  provider.
+
 ### Advanced Configuration
 
 You can customize the OIDC strategy further by adding additional configuration options:
@@ -308,7 +332,7 @@ You can customize the OIDC strategy further by adding additional configuration o
 | name                         | Arbitrary string to identify OIDC provider and segregate it from other OIDC providers                                                                                 | no                      | `"oidc"`                            | `:simple_provider`                                    |
 | issuer                       | Root url for the OIDC authorization server                                                                                                                            | no                      | retrieved from config_endpoint      | `"https://simpleprovider.com"`                        |
 | fetch_user_info              | Fetches user information from userinfo endpoint using the access token. If false, user info is extracted from ID token claims                                          | no                      | `true`                              | `fetch_user_info: false`                              |
-| client_signing_alg           | Expected JWT signing algorithm. If set, tokens signed with a different algorithm are rejected                                                                          | no                      | `nil` (any algorithm accepted)      | `"RS256"`, `"HS256"`                                  |
+| client_signing_alg           | Expected JWT signing algorithm. Tokens signed with any other algorithm are rejected                                                                                     | no                      | `nil` (provider-advertised, else RS256) | `"RS256"`, `"HS256"`                                  |
 | scope                        | OIDC scopes to request. Accepts Array or String; always sent as a space-delimited string                                                                              | `openid` is required    | all scopes offered by OIDC provider | `%w[openid profile email]`                            |
 | response_type                | OAuth2 response type expected from OIDC provider during authorization                                                                                                 | no                      | `"code"`                            | `"code"` or `"id_token"`                              |
 | state                        | Value to be used for the OAuth2 state parameter on the authorization request. Can be a proc that generates a string                                                   | no                      | Random 16 character string          | `Proc.new { SecureRandom.hex(32) }`                   |
@@ -316,21 +340,23 @@ You can customize the OIDC strategy further by adding additional configuration o
 | response_mode                | The response mode per [OIDC spec](https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html)                                                                 | no                      | `nil`                               | `:query`, `:fragment`, `:form_post` or `:web_message` |
 | display                      | Specifies how OIDC authorization server should display the authentication and consent UI pages to the end user                                                        | no                      | `nil`                               | `:page`, `:popup`, `:touch` or `:wap`                 |
 | prompt                       | Specifies whether the OIDC authorization server prompts the end user for reauthentication and consent                                                                 | no                      | `nil`                               | `:none`, `:login`, `:consent` or `:select_account`    |
-| send_nonce                   | Include a nonce in the authorization request and verify it in the ID token                                                                                            | no                      | `true`                              | `true` or `false`                                     |
+| send_nonce                   | Include a nonce in the authorization request and require it in the ID token. Always on for `response_type: 'id_token'`                                                  | no                      | `true`                              | `true` or `false`                                     |
 | send_scope_to_token_endpoint | Should the scope parameter be sent to the authorization token endpoint                                                                                                | no                      | `true`                              | `true` or `false`                                     |
 | post_logout_redirect_uri     | Logout redirect uri to use per the [session management draft](https://openid.net/specs/openid-connect-session-1_0.html)                                               | no                      | `nil`                               | `"https://your_app.com/logout/callback"`              |
-| uid_field                    | Field of the user info response to be used as a unique ID                                                                                                             | no                      | `"sub"`                             | `"sub"` or `"preferred_username"`                     |
+| uid_field                    | **Deprecated**, removed in 2.0.0. Has never had an effect: the uid is always the `sub` claim                                                                            | no                      | `"sub"`                             | Remove from configuration                             |
 | extra_authorize_params       | Hash of extra fixed parameters that will be merged to the authorization request                                                                                       | no                      | `{}`                                | `{"tenant" => "common"}`                              |
 | allow_authorize_params       | List of allowed dynamic parameters that will be merged to the authorization request                                                                                   | no                      | `[]`                                | `[:screen_name]`                                      |
-| pkce                         | Enable [PKCE flow](https://oauth.net/2/pkce/)                                                                                                                         | no                      | `false`                             | `true` or `false`                                     |
+| pkce                         | Enable [PKCE flow](https://oauth.net/2/pkce/)                                                                                                                           | no                      | `true`                              | `true` or `false`                                     |
 | pkce_verifier                | Specify custom PKCE verifier code                                                                                                                                     | no                      | Random 128-character string         | `Proc.new { SecureRandom.hex(64) }`                   |
-| pkce_options                 | Specify custom implementation of the PKCE code challenge/method                                                                                                       | no                      | SHA256(code_challenge) in hex       | Proc to customise the code challenge generation       |
+| pkce_options                 | Specify custom implementation of the PKCE code challenge/method                                                                                                         | no                      | S256 (base64url SHA-256 of verifier) | Proc to customise the code challenge generation       |
 | client_options               | Hash of client options detailed below in a separate table                                                                                                             | yes                     | see below                           | see below                                             |
 | jwt_secret_base64            | Specify the base64-encoded secret used to sign the JWT token for HMAC with SHA2 (e.g. HS256) signing algorithms                                                       | no                      | `client_options.secret`             | `"bXlzZWNyZXQ=\n"`                                    |
 | client_jwk_signing_key       | JWK or JWKS (as JSON string or Hash) for local signature verification without fetching from `jwks_uri`                                                                | no                      | `nil`                               | `'{"kty":"RSA","n":"...","e":"AQAB"}'`                |
 | client_x509_signing_key      | X.509 certificate (PEM format) for local signature verification                                                                                                       | no                      | `nil`                               | PEM string                                            |
 | logout_path                  | Log out is only triggered when the request path ends on this path                                                                                                     | no                      | `"/logout"`                         | `"/sign_out"`                                         |
-| jwks_cache_ttl               | JWKS cache time-to-live in seconds                                                                                                                                    | no                      | `3600` (1 hour)                     | `7200`                                                |
+| jwks_cache_ttl               | JWKS cache time-to-live in seconds, shared by all requests in the process                                                                                               | no                      | `3600` (1 hour)                     | `7200`                                                |
+| discovery_cache_ttl          | Discovery document cache time-to-live in seconds, shared by all requests in the process                                                                                 | no                      | `3600` (1 hour)                     | `0` to disable                                        |
+| clock_skew_leeway            | Seconds of clock drift allowed when checking the ID token `exp` and `nbf` claims                                                                                      | no                      | `60`                                | `0` to disable                                        |
 | hd                           | Google-specific: hosted domain parameter                                                                                                                              | no                      | `nil`                               | `"example.com"`                                       |
 | max_age                      | Maximum authentication age in seconds                                                                                                                                 | no                      | `nil`                               | `3600`                                                |
 | acr_values                   | Authentication Class Reference (ACR) values per [RFC9470](https://www.rfc-editor.org/rfc/rfc9470.html)                                                                | no                      | `nil`                               | `"c1 c2"`                                             |

data/lib/omniauth/oidc/config_fetcher.rb

@@ -3,12 +3,30 @@
 module OmniauthOidc
   # Fetches and parses OpenID Connect configuration from .well-known endpoint
   class ConfigFetcher
+    DEFAULT_CACHE_TTL = 3600 # 1 hour in seconds
+
+    # Discovery fields the gem reads. Missing ones return nil instead of raising NoMethodError.
+    STANDARD_FIELDS = %i[
+      issuer authorization_endpoint token_endpoint userinfo_endpoint jwks_uri
+      end_session_endpoint scopes_supported id_token_signing_alg_values_supported
+    ].freeze
+
+    # Fields without which the gem cannot verify tokens or start a login
+    REQUIRED_FIELDS = %i[issuer authorization_endpoint].freeze
+
+    CACHE = TtlCache.new(ttl: DEFAULT_CACHE_TTL, name: "Discovery")
+    private_constant :CACHE
+
     # Config object with dynamic attribute access for OIDC discovery fields
     class Config
       def initialize(attributes = {})
         @attributes = attributes
       end
 
+      STANDARD_FIELDS.each do |field|
+        define_method(field) { self[field] }
+      end
+
       def [](key)
         @attributes[key.to_sym] || @attributes[key.to_s]
       end
@@ -48,8 +66,7 @@ module OmniauthOidc
         retries = 0
         begin
           response = OmniauthOidc::HttpClient.get(endpoint_url)
-          symbolized_config = deep_symbolize_keys(response)
-          Config.new(symbolized_config)
+          config = Config.new(deep_symbolize_keys(response))
         rescue OmniauthOidc::HttpClient::HttpError => e
           retries += 1
           retry if retries < max_retries
@@ -57,10 +74,31 @@ module OmniauthOidc
         rescue StandardError => e
           raise OmniauthOidc::ConfigurationError, "Failed to fetch OIDC configuration: #{e.message}"
         end
+
+        validate!(config, endpoint_url)
+        config
+      end
+
+      # Fetches the discovery document, reusing it across requests for ttl seconds.
+      # Failed fetches are not cached. A ttl of 0 disables caching.
+      def fetch_cached(endpoint_url, ttl: DEFAULT_CACHE_TTL)
+        CACHE.fetch(endpoint_url, ttl: ttl) { fetch(endpoint_url) }
+      end
+
+      def clear_cache!
+        CACHE.clear!
       end
 
       private
 
+      def validate!(config, endpoint_url)
+        missing = REQUIRED_FIELDS.reject { |field| config[field].is_a?(String) && !config[field].empty? }
+        return if missing.empty?
+
+        raise OmniauthOidc::ConfigurationError,
+              "OIDC configuration from #{endpoint_url} is missing required fields: #{missing.join(", ")}"
+      end
+
       # Recursively converts keys of a hash to symbols while retaining the original string keys
       def deep_symbolize_keys(hash)
         result = {}

data/lib/omniauth/oidc/http_client.rb

@@ -11,6 +11,12 @@ module OmniauthOidc
 
     MAX_REDIRECTS = 5
 
+    # Explicit timeouts in seconds. Net::HTTP defaults to 60s each, which would let a
+    # hanging provider tie up the calling thread for minutes.
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 10
+    WRITE_TIMEOUT = 10
+
     def self.get(url, headers: {})
       uri = URI.parse(url)
       request = Net::HTTP::Get.new(uri)
@@ -33,7 +39,8 @@ module OmniauthOidc
 
     def self.execute_request(uri, request)
       OmniauthOidc::Logging.instrument("http.request", method: request.method, uri: uri.to_s) do
-        Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
+        Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https", open_timeout: OPEN_TIMEOUT,
+                                                read_timeout: READ_TIMEOUT, write_timeout: WRITE_TIMEOUT) do |http|
           http.request(request)
         end
       end
@@ -55,7 +62,8 @@ module OmniauthOidc
         redirect_uri = URI.join(url, location) unless redirect_uri.host
 
         OmniauthOidc::Logging.debug("Following redirect", from: url, to: redirect_uri.to_s)
-        follow_redirect(redirect_uri, headers: headers, redirects_remaining: redirects_remaining - 1)
+        follow_redirect(redirect_uri, headers: redirect_headers(URI.parse(url), redirect_uri, headers),
+                                      redirects_remaining: redirects_remaining - 1)
       else
         raise HttpError, "HTTP request failed: #{response.code} #{response.message} for #{url}"
       end
@@ -71,6 +79,20 @@ module OmniauthOidc
     end
     private_class_method :follow_redirect
 
+    # Refuses HTTPS to HTTP downgrades, and drops credentials when a redirect leaves the
+    # original origin, so a bearer token is never sent in cleartext or to another host.
+    def self.redirect_headers(from, to, headers)
+      if from.scheme == "https" && to.scheme != "https"
+        raise HttpError, "Refusing to follow redirect from #{from} to non-HTTPS #{to}"
+      end
+
+      same_origin = [from.scheme, from.host, from.port] == [to.scheme, to.host, to.port]
+      return headers if same_origin
+
+      headers.reject { |key, _| key.to_s.casecmp?("Authorization") }
+    end
+    private_class_method :redirect_headers
+
     def self.parse_json_response(body)
       JSON.parse(body)
     rescue JSON::ParserError => e

data/lib/omniauth/oidc/jwks_cache.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
 
 module OmniauthOidc
-  # Thread-safe JWKS cache with configurable TTL and force refresh capability
-  class JwksCache
+  # Process-wide JWKS cache with configurable TTL and force refresh capability
+  class JwksCache < TtlCache
     DEFAULT_TTL = 3600 # 1 hour in seconds
-
-    CacheEntry = Struct.new(:keys, :fetched_at, keyword_init: true)
+    INSTANCE_MUTEX = Mutex.new
+    private_constant :INSTANCE_MUTEX
 
     class << self
       def instance
-        @instance ||= new
+        @instance || INSTANCE_MUTEX.synchronize { @instance ||= new }
       end
 
       # Clear all cached keys (useful for testing)
@@ -24,66 +24,7 @@ module OmniauthOidc
     end
 
     def initialize(ttl: DEFAULT_TTL)
-      @ttl = ttl
-      @cache = {}
-      @mutex = Mutex.new
-    end
-
-    # Fetch JWKS, using cache if valid
-    def fetch(jwks_uri, force_refresh: false, &block)
-      @mutex.synchronize do
-        entry = @cache[jwks_uri]
-
-        if !force_refresh && entry && !expired?(entry)
-          Logging.debug("JWKS cache hit", jwks_uri: jwks_uri)
-          return entry.keys
-        end
-
-        Logging.info("JWKS cache miss, fetching", jwks_uri: jwks_uri, force_refresh: force_refresh)
-        keys = block.call
-        @cache[jwks_uri] = CacheEntry.new(keys: keys, fetched_at: Time.now)
-        keys
-      end
-    end
-
-    # Check if a specific URI's cache is valid
-    def valid?(jwks_uri)
-      @mutex.synchronize do
-        entry = @cache[jwks_uri]
-        entry && !expired?(entry)
-      end
-    end
-
-    # Invalidate a specific URI's cache
-    def invalidate(jwks_uri)
-      @mutex.synchronize do
-        @cache.delete(jwks_uri)
-        Logging.debug("JWKS cache invalidated", jwks_uri: jwks_uri)
-      end
-    end
-
-    # Clear entire cache
-    def clear!
-      @mutex.synchronize do
-        @cache.clear
-        Logging.debug("JWKS cache cleared")
-      end
-    end
-
-    # Get current TTL
-    attr_reader :ttl
-
-    # Update TTL (affects future expiration checks)
-    def ttl=(value)
-      @mutex.synchronize do
-        @ttl = value
-      end
-    end
-
-    private
-
-    def expired?(entry)
-      Time.now - entry.fetched_at > @ttl
+      super(ttl: ttl, name: "JWKS")
     end
   end
 end

data/lib/omniauth/oidc/ttl_cache.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module OmniauthOidc
+  # Thread-safe cache with a per-entry TTL.
+  #
+  # Reads take a short global lock only. Fetches run under a per-key lock, so a
+  # slow or hanging upstream for one key never blocks cache hits for other keys,
+  # and concurrent misses for the same key trigger a single fetch.
+  class TtlCache
+    Entry = Struct.new(:value, :fetched_at, keyword_init: true)
+
+    attr_reader :ttl
+
+    def initialize(ttl:, name: "TTL")
+      @ttl = ttl
+      @name = name
+      @entries = {}
+      @locks = {}
+      @mutex = Mutex.new
+    end
+
+    # Returns the cached value for key, calling the block to fetch it on a miss.
+    #
+    # ttl:           seconds an entry stays valid (defaults to the cache TTL)
+    # force_refresh: fetch even if the entry is still valid
+    # min_age:       with force_refresh, reuse an entry fetched less than this many
+    #                seconds ago. Rate limits refreshes that callers can trigger.
+    def fetch(key, force_refresh: false, ttl: nil, min_age: 0, &block)
+      ttl ||= @ttl
+      entry = read(key)
+      return hit(key, entry) if !force_refresh && younger_than?(entry, ttl)
+
+      lock_for(key).synchronize do
+        # Another thread may have fetched while this one waited for the lock
+        entry = read(key)
+        return hit(key, entry) if younger_than?(entry, force_refresh ? min_age : ttl)
+
+        Logging.info("#{@name} cache miss, fetching", key: key, force_refresh: force_refresh)
+        value = block.call
+        @mutex.synchronize { @entries[key] = Entry.new(value: value, fetched_at: Time.now) }
+        value
+      end
+    end
+
+    def valid?(key)
+      younger_than?(read(key), @ttl)
+    end
+
+    def invalidate(key)
+      @mutex.synchronize { @entries.delete(key) }
+      Logging.debug("#{@name} cache invalidated", key: key)
+    end
+
+    def clear!
+      @mutex.synchronize { @entries.clear }
+      Logging.debug("#{@name} cache cleared")
+    end
+
+    def ttl=(value)
+      @mutex.synchronize { @ttl = value }
+    end
+
+    private
+
+    def read(key)
+      @mutex.synchronize { @entries[key] }
+    end
+
+    def hit(key, entry)
+      Logging.debug("#{@name} cache hit", key: key)
+      entry.value
+    end
+
+    def younger_than?(entry, seconds)
+      !entry.nil? && Time.now - entry.fetched_at < seconds
+    end
+
+    def lock_for(key)
+      @mutex.synchronize { @locks[key] ||= Mutex.new }
+    end
+  end
+end

data/lib/omniauth/oidc/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OmniauthOidc
-  VERSION = "1.0.1"
+  VERSION = "1.1.0"
 end

data/lib/omniauth/strategies/oidc/callback.rb

@@ -9,11 +9,10 @@ module OmniAuth
           OmniauthOidc::Logging.instrument("callback_phase.start", provider: name) do
             handle_callback_errors do
               validate_callback_params!
+              next missing_response_type_failure unless params.key?(configured_response_type)
 
               options.issuer = issuer if options.issuer.nil? || options.issuer.empty?
 
-              verify_id_token!(params["id_token"]) if configured_response_type == "id_token"
-
               client.redirect_uri = redirect_uri
 
               if configured_response_type == "id_token"
@@ -21,6 +20,7 @@ module OmniAuth
               else
                 handle_code_response
               end
+              verify_subject!
 
               super
             end
@@ -34,6 +34,9 @@ module OmniAuth
         rescue CallbackError => e
           OmniauthOidc::Logging.error("Callback error", error: e.error, reason: e.error_reason)
           fail!(e.error, e)
+        rescue OmniauthOidc::ConfigurationError, OmniauthOidc::JwksError => e
+          OmniauthOidc::Logging.error("Provider setup error", error: e.class.name, message: e.message)
+          fail!(e.is_a?(OmniauthOidc::JwksError) ? :jwks_error : :configuration_error, e)
         rescue OmniauthOidc::TokenError => e
           OmniauthOidc::Logging.error("Token error", error: e.class.name, message: e.message)
           fail!(:token_error, e)
@@ -48,7 +51,7 @@ module OmniAuth
           fail!(:failed_to_connect, e)
         end
 
-        def validate_callback_params! # rubocop:disable Naming/PredicateMethod
+        def validate_callback_params!
           error = params["error_reason"] || params["error"]
           error_description = params["error_description"] || params["error_reason"]
           invalid_state = (options.require_state && params["state"].to_s.empty?) || params["state"] != stored_state
@@ -58,25 +61,29 @@ module OmniAuth
                                  error_uri: params["error_uri"]
           end
           raise CallbackError, error: :csrf_detected, error_reason: "Invalid 'state' parameter" if invalid_state
+        end
 
-          valid_response_type?
+        def missing_response_type_failure
+          error_attrs = RESPONSE_TYPE_EXCEPTIONS[configured_response_type]
+          fail!(error_attrs[:key], error_attrs[:exception_class].new(params["error"]))
         end
 
         def handle_code_response
           # Get access token via token exchange
           @access_token = fetch_access_token
 
-          # Verify the ID token from the token response
-          verify_id_token!(@access_token.id_token) if @access_token.id_token
+          # Verify the ID token from the token response once, and reuse the result below
+          @verified_id_token = verify_id_token!(@access_token.id_token)
 
           # Fetch and set user info
           @user_info = fetch_user_info
         end
 
         def handle_id_token_response
-          # For id_token response type, extract user data directly from the token
-          decoded_token = decode_id_token(params["id_token"])
-          @user_info = OmniauthOidc::ResponseObjects::UserInfo.new(decoded_token.raw_attributes)
+          # For id_token response type, extract user data directly from the verified token
+          # to_s: a bare "?id_token" param is nil and must fail verification, not skip it
+          @verified_id_token = verify_id_token!(params["id_token"].to_s)
+          @user_info = OmniauthOidc::ResponseObjects::UserInfo.new(@verified_id_token.raw_attributes)
 
           # Create a minimal access token structure for credentials
           @access_token = OmniauthOidc::ResponseObjects::AccessToken.new(
@@ -95,10 +102,8 @@ module OmniAuth
               redirect_uri: redirect_uri
             }
 
-            if options.pkce
-              token_request_params[:code_verifier] =
-                params["code_verifier"] || session.delete(session_key("pkce.verifier"))
-            end
+            # The verifier comes only from the session. Request params are attacker controlled.
+            token_request_params[:code_verifier] = stored_pkce_verifier if options.pkce
 
             set_client_options_for_callback_phase
 
@@ -106,44 +111,49 @@ module OmniAuth
           end
         end
 
+        def stored_pkce_verifier
+          verifier = session.delete(session_key("pkce.verifier"))
+          return verifier unless verifier.to_s.empty?
+
+          raise OmniauthOidc::TokenError, "No PKCE code verifier stored in the session for this login"
+        end
+
         def fetch_user_info
           return minimal_user_info_from_token unless options.fetch_user_info
 
-          OmniauthOidc::Logging.instrument("userinfo.fetch", provider: name) do
-            # Use our custom client to fetch userinfo
-            userinfo_data = client.userinfo!(@access_token.access_token).raw_attributes
-
-            # Merge with ID token claims if available
-            if @access_token.id_token
-              id_token_claims = decode_id_token(@access_token.id_token).raw_attributes
-              userinfo_data = id_token_claims.merge(userinfo_data)
-            end
+          userinfo_data = OmniauthOidc::Logging.instrument("userinfo.fetch", provider: name) do
+            client.userinfo!(@access_token.access_token).raw_attributes
+          end
+          return OmniauthOidc::ResponseObjects::UserInfo.new(userinfo_data) unless @verified_id_token
 
-            OmniauthOidc::ResponseObjects::UserInfo.new(userinfo_data)
+          id_token_claims = @verified_id_token.raw_attributes
+          # OIDC Core 5.3.4: UserInfo values must not be used unless its sub matches the ID token
+          unless userinfo_data["sub"] == id_token_claims["sub"]
+            OmniauthOidc::Logging.error("UserInfo sub does not match ID token sub, using ID token claims only")
+            return minimal_user_info_from_token
           end
+
+          OmniauthOidc::ResponseObjects::UserInfo.new(id_token_claims.merge(userinfo_data))
         rescue StandardError => e
           OmniauthOidc::Logging.warn("Failed to fetch userinfo, falling back to ID token", error: e.message)
           minimal_user_info_from_token
         end
 
         def minimal_user_info_from_token
-          return empty_user_info unless @access_token&.id_token
-
-          decoded = decode_id_token(@access_token.id_token)
-          OmniauthOidc::ResponseObjects::UserInfo.new(decoded.raw_attributes)
-        end
+          return empty_user_info unless @verified_id_token
 
-        def empty_user_info
-          OmniauthOidc::ResponseObjects::UserInfo.new({})
+          OmniauthOidc::ResponseObjects::UserInfo.new(@verified_id_token.raw_attributes)
         end
 
-        def valid_response_type?
-          return true if params.key?(configured_response_type)
+        # A login without a subject must never complete: a nil uid can match the wrong local account
+        def verify_subject!
+          return unless uid.to_s.empty?
 
-          error_attrs = RESPONSE_TYPE_EXCEPTIONS[configured_response_type]
-          fail!(error_attrs[:key], error_attrs[:exception_class].new(params["error"]))
+          raise OmniauthOidc::TokenVerificationError, "Neither the ID token nor UserInfo provided a subject (sub)"
+        end
 
-          false
+        def empty_user_info
+          OmniauthOidc::ResponseObjects::UserInfo.new({})
         end
 
         def configured_response_type

data/lib/omniauth/strategies/oidc/request.rb

@@ -7,12 +7,12 @@ module OmniAuth
       module Request
         def request_phase
           OmniauthOidc::Logging.instrument("request_phase.start", provider: name) do
-            @identifier = client_options.identifier
-            @secret = secret
-
             set_client_options_for_request_phase
             redirect authorize_uri
           end
+        rescue OmniauthOidc::ConfigurationError => e
+          OmniauthOidc::Logging.error("Configuration error", error: e.class.name, message: e.message)
+          fail!(:configuration_error, e)
         end
 
         def authorize_uri # rubocop:disable Metrics/AbcSize
@@ -50,7 +50,7 @@ module OmniAuth
             ui_locales: params["ui_locales"],
             claims_locales: params["claims_locales"],
             prompt: options.prompt,
-            nonce: (new_nonce if options.send_nonce),
+            nonce: (new_nonce if nonce_required?),
             hd: options.hd,
             acr_values: options.acr_values
           }
@@ -75,7 +75,7 @@ module OmniAuth
           client_options.userinfo_endpoint = config.userinfo_endpoint
           client_options.jwks_uri = config.jwks_uri
 
-          return unless config.respond_to?(:end_session_endpoint) && config.end_session_endpoint
+          return unless config.end_session_endpoint
 
           client_options.end_session_endpoint = config.end_session_endpoint
         end

data/lib/omniauth/strategies/oidc/verify.rb

@@ -5,6 +5,15 @@ module OmniAuth
     class Oidc
       # Token verification phase
       module Verify # rubocop:disable Metrics/ModuleLength
+        HMAC_ALGORITHMS = %w[HS256 HS384 HS512].freeze
+
+        # Algorithm assumed when neither client_signing_alg nor the discovery document names one
+        DEFAULT_SIGNING_ALGORITHM = "RS256"
+
+        # Minimum seconds between JWKS refreshes triggered by an unknown kid, so tokens with
+        # made-up kids cannot be used to hammer the provider's JWKS endpoint.
+        JWKS_REFRESH_MIN_INTERVAL = 60
+
         def secret
           base64_decoded_jwt_secret || client_options.secret
         end
@@ -27,19 +36,20 @@ module OmniAuth
                           end
         end
 
-        # Force refresh JWKS cache and retry verification
+        # Refetch the JWKS, at most once per JWKS_REFRESH_MIN_INTERVAL for each jwks_uri
         def public_key_with_refresh
-          OmniauthOidc::Logging.info("Force refreshing JWKS cache")
-          OmniauthOidc::JwksCache.invalidate(config.jwks_uri)
-          @public_key = nil
-          @fetch_key = nil
-          public_key
+          return public_key if configured_public_key || config.jwks_uri.nil?
+
+          OmniauthOidc::Logging.info("Refreshing JWKS", jwks_uri: config.jwks_uri)
+          @public_key = fetch_key(force_refresh: true)
         end
 
         private
 
-        def fetch_key
-          @fetch_key ||= OmniauthOidc::JwksCache.instance.fetch(config.jwks_uri) do
+        def fetch_key(force_refresh: false)
+          OmniauthOidc::JwksCache.instance.fetch(config.jwks_uri, force_refresh: force_refresh,
+                                                                  ttl: options.jwks_cache_ttl.to_i,
+                                                                  min_age: JWKS_REFRESH_MIN_INTERVAL) do
             OmniauthOidc::Logging.instrument("jwks.fetch", jwks_uri: config.jwks_uri) do
               response = OmniauthOidc::HttpClient.get(config.jwks_uri)
               OmniauthOidc::JwkHandler.parse_jwks(response)
@@ -56,6 +66,14 @@ module OmniAuth
           Base64.decode64(options.jwt_secret_base64)
         end
 
+        # An empty key lets anyone forge HS* tokens (CVE-2026-45363), so never verify with one
+        def hmac_secret
+          key = secret.to_s
+          return key unless key.empty?
+
+          raise OmniauthOidc::ConfigurationError, "HMAC secret for ID token verification is empty"
+        end
+
         def verify_id_token!(id_token)
           return unless id_token
 
@@ -66,37 +84,67 @@ module OmniAuth
           end
         end
 
-        def verify_claims!(decoded_token) # rubocop:disable Metrics/MethodLength
+        def verify_claims!(decoded_token)
           claims = decoded_token.raw_attributes
 
-          # Verify issuer
-          if config.issuer && claims["iss"] != config.issuer
-            raise OmniauthOidc::InvalidIssuerError,
-                  "Issuer mismatch. Expected: #{config.issuer}, Got: #{claims["iss"]}"
-          end
+          # Consume the nonce before any check can fail, so it stays single use
+          expected_nonce = stored_nonce
+
+          verify_issuer!(claims)
+          verify_audience!(claims)
+          verify_nonce!(claims, expected_nonce)
+          verify_expiration!(claims)
 
-          # Verify audience
+          decoded_token
+        end
+
+        # The discovery document is validated to always carry an issuer, so this check
+        # cannot be skipped by a provider that omits it.
+        def verify_issuer!(claims)
+          return if claims["iss"] == config.issuer
+
+          raise OmniauthOidc::InvalidIssuerError,
+                "Issuer mismatch. Expected: #{config.issuer}, Got: #{claims["iss"]}"
+        end
+
+        def verify_audience!(claims)
           audience = claims["aud"]
           expected_aud = client_options.identifier
-          unless audience_matches?(audience, expected_aud)
-            raise OmniauthOidc::InvalidAudienceError,
-                  "Audience mismatch. Expected: #{expected_aud}, Got: #{audience}"
-          end
+          return if audience_matches?(audience, expected_aud)
 
-          # Verify nonce if present
-          expected_nonce = params["nonce"].presence || stored_nonce
-          if expected_nonce && claims["nonce"] != expected_nonce
-            raise OmniauthOidc::InvalidNonceError,
-                  "Nonce mismatch. Expected: #{expected_nonce}, Got: #{claims["nonce"]}"
-          end
+          raise OmniauthOidc::InvalidAudienceError,
+                "Audience mismatch. Expected: #{expected_aud}, Got: #{audience}"
+        end
 
-          # Verify expiration
-          if claims["exp"] && Time.at(claims["exp"].to_i) < Time.now
-            raise OmniauthOidc::TokenExpiredError,
-                  "Token expired at #{Time.at(claims["exp"].to_i)}"
+        # The expected nonce comes only from the session. Never read it from request params:
+        # the caller controls those. Nonce values are left out of messages because they end
+        # up in logs.
+        def verify_nonce!(claims, expected_nonce)
+          if expected_nonce.nil?
+            return unless nonce_required?
+
+            raise OmniauthOidc::InvalidNonceError, "No nonce stored in the session for this login"
           end
+          return if claims["nonce"] == expected_nonce
 
-          decoded_token
+          raise OmniauthOidc::InvalidNonceError, "ID token nonce does not match the authorization request"
+        end
+
+        # OIDC Core 3.2.2.1 requires a nonce for the implicit (id_token) flow, so it is
+        # always used there, regardless of send_nonce.
+        def nonce_required?
+          options.send_nonce || options.response_type.to_s == "id_token"
+        end
+
+        # exp is required by OIDC Core 3.1.3.7 and must be a NumericDate (RFC 7519 2).
+        # Clock skew between us and the provider is tolerated up to clock_skew_leeway.
+        def verify_expiration!(claims)
+          exp = claims["exp"]
+          raise OmniauthOidc::TokenVerificationError, "ID token is missing the exp claim" if exp.nil?
+          raise OmniauthOidc::TokenVerificationError, "ID token exp claim is not a number" unless exp.is_a?(Numeric)
+          return if Time.now.to_i < exp + clock_skew_leeway
+
+          raise OmniauthOidc::TokenExpiredError, "Token expired at #{Time.at(exp)}"
         end
 
         def audience_matches?(audience, expected)
@@ -106,16 +154,23 @@ module OmniAuth
           false
         end
 
+        def clock_skew_leeway
+          leeway = options.clock_skew_leeway
+          return leeway if leeway.is_a?(Integer) && leeway >= 0
+
+          raise OmniauthOidc::ConfigurationError,
+                "clock_skew_leeway must be a non-negative Integer, got #{leeway.inspect}"
+        end
+
         def decode_id_token(id_token)
           # First decode without verification to get the algorithm and kid
           _unverified_payload, unverified_header = JWT.decode(id_token, nil, false)
-          algorithm = unverified_header["alg"]
-          kid = unverified_header["kid"]
+          algorithm = unverified_header["alg"].to_s
 
-          validate_client_algorithm!(algorithm.to_sym)
+          validate_algorithm!(algorithm)
 
           # Get the appropriate key/secret for verification
-          key = keyset_for_algorithm(algorithm.to_sym, kid)
+          key = keyset_for_algorithm(algorithm, unverified_header["kid"])
 
           # Decode and verify
           verify_signature!(id_token, key, algorithm)
@@ -124,56 +179,55 @@ module OmniAuth
         end
 
         def keyset_for_algorithm(algorithm, kid = nil)
-          case algorithm
-          when :HS256, :HS384, :HS512
-            secret
-          else
-            keys = public_key
-            if keys.is_a?(Array)
-              OmniauthOidc::JwkHandler.find_key(keys, kid)
-            else
-              keys
-            end
-          end
+          return hmac_secret if HMAC_ALGORITHMS.include?(algorithm)
+
+          keys = public_key
+          return keys unless keys.is_a?(Array)
+
+          # The provider may have rotated its signing keys since the JWKS was cached
+          keys = public_key_with_refresh if kid && keys.none? { |key| key.kid == kid }
+          OmniauthOidc::JwkHandler.find_key(keys, kid)
         end
 
         def verify_signature!(id_token, key, algorithm)
-          # Use jwt gem to decode and verify
           payload, _header = JWT.decode(
             id_token,
             key,
             true, # verify signature
-            {
-              algorithm: algorithm,
-              verify_expiration: false # We verify this manually in verify_claims!
-            }
+            # exp is verified manually in verify_claims!
+            { algorithm: algorithm, verify_expiration: false, nbf_leeway: clock_skew_leeway }
           )
 
           # Create our custom IdToken object
           OmniauthOidc::ResponseObjects::IdToken.new(payload.merge("algorithm" => algorithm))
         rescue JWT::VerificationError => e
-          # Try refreshing JWKS cache and retry once
-          if key.is_a?(Array) && !@signature_retry_attempted
-            @signature_retry_attempted = true
-            OmniauthOidc::Logging.warn("Signature verification failed, refreshing JWKS and retrying")
-            refreshed_key = public_key_with_refresh
-            return verify_signature!(id_token, refreshed_key, algorithm)
-          end
           raise OmniauthOidc::InvalidSignatureError, "JWT signature verification failed: #{e.message}"
         rescue JWT::IncorrectAlgorithm => e
           raise OmniauthOidc::InvalidAlgorithmError, "Unexpected JWT algorithm: #{e.message}"
         end
 
-        # Check for jwt to match defined client_signing_alg
-        def validate_client_algorithm!(algorithm)
-          client_signing_alg = options.client_signing_alg&.to_sym
+        # The token header is attacker controlled, so the accepted algorithms come from
+        # configuration only. "none" is never accepted.
+        def validate_algorithm!(algorithm)
+          allowed = allowed_signing_algorithms
+          return if allowed.include?(algorithm)
+
+          raise OmniauthOidc::InvalidAlgorithmError,
+                "Received JWT is signed with #{algorithm.empty? ? "no algorithm" : algorithm}, " \
+                "but only #{allowed.empty? ? "signed tokens" : allowed.join(", ")} are accepted"
+        end
 
-          return unless client_signing_alg
-          return if algorithm == client_signing_alg
+        # client_signing_alg when set, otherwise the algorithms the discovery document
+        # advertises for ID tokens, otherwise RS256.
+        def allowed_signing_algorithms
+          algorithms = if options.client_signing_alg
+                         [options.client_signing_alg]
+                       else
+                         Array(config.id_token_signing_alg_values_supported)
+                       end
+          algorithms = [DEFAULT_SIGNING_ALGORITHM] if algorithms.empty?
 
-          reason = "Received JWT is signed with #{algorithm}, but client_signing_alg is " \
-                   "configured for #{client_signing_alg}"
-          raise OmniauthOidc::InvalidAlgorithmError, reason
+          algorithms.map(&:to_s) - ["none"]
         end
 
         def configured_public_key

data/lib/omniauth/strategies/oidc.rb

@@ -72,8 +72,8 @@ module OmniAuth
       option :post_logout_redirect_uri
       option :extra_authorize_params, {}
       option :allow_authorize_params, []
-      option :uid_field, "sub"
-      option :pkce, false
+      option :uid_field, "sub" # Deprecated: never had an effect, the uid is always `sub`. Removed in 2.0.0
+      option :pkce, true
       option :pkce_verifier, nil
       option :pkce_options, {
         code_challenge: proc { |verifier|
@@ -84,11 +84,21 @@ module OmniAuth
 
       option :logout_path, "/logout"
 
-      # JWKS cache configuration
-      option :jwks_cache_ttl, 3600 # 1 hour default
+      # JWKS and discovery document cache TTLs in seconds
+      option :jwks_cache_ttl, OmniauthOidc::JwksCache::DEFAULT_TTL
+      option :discovery_cache_ttl, OmniauthOidc::ConfigFetcher::DEFAULT_CACHE_TTL
 
+      # Seconds of clock drift tolerated when checking ID token exp and nbf
+      option :clock_skew_leeway, 60
+
+      def initialize(app, *args, &block)
+        super
+        warn_uid_field_deprecation
+      end
+
+      # Always the subject claim: the only identifier OIDC guarantees to be stable and unique per issuer
       def uid
-        user_info.raw_attributes[options.uid_field.to_sym] || user_info.sub
+        user_info.sub
       end
 
       info do
@@ -143,12 +153,15 @@ module OmniAuth
         client_options.end_session_endpoint ||= config.end_session_endpoint
       end
 
-      # Config is built from the json response from the OIDC config endpoint
+      # Config is built from the json response from the OIDC config endpoint.
+      # OmniAuth dups the strategy per request, so the process-wide cache is what avoids
+      # refetching the discovery document on every request.
       def config
         validate_configuration!
 
-        @config ||= OmniauthOidc::Logging.instrument("config.fetch", config_endpoint: client_options.config_endpoint) do
-          OmniauthOidc::ConfigFetcher.fetch(client_options.config_endpoint)
+        endpoint = client_options.config_endpoint
+        @config ||= OmniauthOidc::Logging.instrument("config.fetch", config_endpoint: endpoint) do
+          OmniauthOidc::ConfigFetcher.fetch_cached(endpoint, ttl: options.discovery_cache_ttl.to_i)
         end
       end
 
@@ -173,6 +186,13 @@ module OmniAuth
 
       private
 
+      def warn_uid_field_deprecation
+        return if options.uid_field.to_s == "sub"
+
+        OmniauthOidc::Logging.warn("The uid_field option is deprecated and has no effect: the uid is always the " \
+                                   "sub claim. Remove it from the #{name} provider; it is removed in 2.0.0.")
+      end
+
       def validate_configuration!
         missing = []
         missing << :identifier if client_options.identifier.to_s.empty?

data/lib/omniauth_oidc.rb

@@ -3,6 +3,7 @@
 require_relative "omniauth/oidc/version"
 require_relative "omniauth/oidc/errors"
 require_relative "omniauth/oidc/logging"
+require_relative "omniauth/oidc/ttl_cache"
 require_relative "omniauth/oidc/jwks_cache"
 require_relative "omniauth/oidc/http_client"
 require_relative "omniauth/oidc/response_objects"

data/omniauth_oidc.gemspec

@@ -33,7 +33,8 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   # Runtime dependencies
-  spec.add_dependency "jwt", ">= 2.7", "< 4.0"
+  # Excludes releases affected by CVE-2026-45363 (empty-key HMAC bypass): fixed in 2.10.3 and 3.2.0
+  spec.add_dependency "jwt", ">= 2.10.3", "!= 3.0.0", "!= 3.1.0", "!= 3.1.1", "!= 3.1.2", "< 4.0"
   spec.add_dependency "omniauth", "~> 2.1"
 
   # Ruby 4.0+ compatibility - ostruct no longer in default gems

data/sig/omniauth_oidc.rbs

@@ -56,6 +56,9 @@ module OmniauthOidc
     end
 
     MAX_REDIRECTS: Integer
+    OPEN_TIMEOUT: Integer
+    READ_TIMEOUT: Integer
+    WRITE_TIMEOUT: Integer
 
     def self.get: (String url, ?headers: Hash[String, String]) -> Hash[String, untyped]
     def self.post: (String url, ?body: String?, ?headers: Hash[String, String]) -> Hash[String, untyped]
@@ -91,41 +94,60 @@ module OmniauthOidc
     def self.find_key: (Array[KeyWithId] keys, ?String? kid) -> OpenSSL::PKey::PKey?
   end
 
-  # JWKS Cache
-  class JwksCache
-    DEFAULT_TTL: Integer
-
-    class CacheEntry
-      attr_accessor keys: untyped
+  # Thread-safe TTL cache
+  class TtlCache
+    class Entry
+      attr_accessor value: untyped
       attr_accessor fetched_at: Time
 
-      def initialize: (?keys: untyped, ?fetched_at: Time) -> void
+      def initialize: (?value: untyped, ?fetched_at: Time) -> void
     end
 
+    attr_reader ttl: Numeric
+
+    def initialize: (ttl: Numeric, ?name: String) -> void
+    def fetch: (String key, ?force_refresh: bool, ?ttl: Numeric?, ?min_age: Numeric) { () -> untyped } -> untyped
+    def valid?: (String key) -> bool
+    def invalidate: (String key) -> void
+    def clear!: () -> void
+    def ttl=: (Numeric value) -> void
+  end
+
+  # JWKS Cache
+  class JwksCache < TtlCache
+    DEFAULT_TTL: Integer
+
     def self.instance: () -> JwksCache
     def self.clear!: () -> void
     def self.invalidate: (String jwks_uri) -> void
 
-    attr_reader ttl: Integer
-
-    def initialize: (?ttl: Integer) -> void
-    def fetch: (String jwks_uri, ?force_refresh: bool) { () -> untyped } -> untyped
-    def valid?: (String jwks_uri) -> bool
-    def invalidate: (String jwks_uri) -> void
-    def clear!: () -> void
-    def ttl=: (Integer value) -> void
+    def initialize: (?ttl: Numeric) -> void
   end
 
   # Config Fetcher
   class ConfigFetcher
+    DEFAULT_CACHE_TTL: Integer
+    STANDARD_FIELDS: Array[Symbol]
+    REQUIRED_FIELDS: Array[Symbol]
+
     class Config
       def initialize: (?Hash[Symbol | String, untyped] attributes) -> void
       def []: (String | Symbol key) -> untyped
       def []=: (String | Symbol key, untyped value) -> untyped
       def respond_to_missing?: (Symbol method_name, ?bool include_private) -> bool
+      def issuer: () -> String?
+      def authorization_endpoint: () -> String?
+      def token_endpoint: () -> String?
+      def userinfo_endpoint: () -> String?
+      def jwks_uri: () -> String?
+      def end_session_endpoint: () -> String?
+      def scopes_supported: () -> Array[String]?
+      def id_token_signing_alg_values_supported: () -> Array[String]?
     end
 
     def self.fetch: (String endpoint_url, ?max_retries: Integer) -> Config
+    def self.fetch_cached: (String endpoint_url, ?ttl: Numeric) -> Config
+    def self.clear_cache!: () -> void
   end
 
   # Response Objects

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth_oidc
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Suleyman Musayev
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-03-23 00:00:00.000000000 Z
+date: 2026-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -16,7 +16,19 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: 2.10.3
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.1.1
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.1.2
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -26,7 +38,19 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: 2.10.3
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.1.1
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 3.1.2
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -67,6 +91,7 @@ files:
 - lib/omniauth/oidc/jwks_cache.rb
 - lib/omniauth/oidc/logging.rb
 - lib/omniauth/oidc/response_objects.rb
+- lib/omniauth/oidc/ttl_cache.rb
 - lib/omniauth/oidc/version.rb
 - lib/omniauth/strategies/oidc.rb
 - lib/omniauth/strategies/oidc/callback.rb