omniauth_openid_federation 1.3.2 → 2.1.0

data/lib/omniauth_openid_federation/jwe.rb

@@ -0,0 +1,26 @@
+require "jwe"
+
+require_relative "errors"
+
+module OmniauthOpenidFederation
+  # Compact-serialization JWE helpers for nested JWTs (sign then encrypt).
+  module Jwe
+    PARTS_COUNT = 5
+
+    def self.encrypted?(token)
+      token.to_s.count(".") + 1 == PARTS_COUNT
+    end
+
+    def self.encrypt(plaintext, public_key, alg:, enc:)
+      ::JWE.encrypt(plaintext.to_s, public_key, alg: alg.to_s, enc: enc.to_s)
+    end
+
+    def self.decrypt(ciphertext, private_key)
+      ::JWE.decrypt(ciphertext.to_s, private_key)
+    rescue ::JWE::DecodeError, ::JWE::InvalidData, ::JWE::BadCEK, ::JWE::NotImplementedError, ArgumentError => error
+      raise OmniauthOpenidFederation::DecryptionError,
+        "Failed to decrypt JWE: #{error.message}",
+        error.backtrace
+    end
+  end
+end

data/lib/omniauth_openid_federation/jwks/decode.rb

@@ -113,19 +113,6 @@ module OmniauthOpenidFederation
           else
             raise e
           end
-        rescue => e
-          # Other errors might be due to key rotation
-          if retried
-            # If already re-tried to fetch, raise error
-            error_msg = "JWT decode failed after cache refresh: #{e.class} - #{e.message}"
-            OmniauthOpenidFederation::Logger.error("[Jwks::Decode] #{error_msg}")
-            raise ValidationError, error_msg, e.backtrace
-          else
-            OmniauthOpenidFederation::Logger.warn("[Jwks::Decode] JWT decode error (clearing cache and retrying - possible key rotation): #{e.class} - #{e.message}")
-            # Reset cache to force re-fetching of keys
-            OmniauthOpenidFederation::Cache.delete_jwks(jwks_uri)
-            run(encoded_jwt, jwks_uri, retried: true, entity_statement_keys: entity_statement_keys, &block)
-          end
         end
       end
 

data/lib/omniauth_openid_federation/jwks/fetch.rb

@@ -1,4 +1,3 @@
-require "http"
 require "jwt"
 require "openssl"
 require_relative "../logger"
@@ -44,52 +43,30 @@ module OmniauthOpenidFederation
         cache_ttl ||= config.cache_ttl
         rotate_on_errors = config.rotate_on_errors
 
-        # Use cache adapter if available, otherwise fetch directly
         if CacheAdapter.available?
-          if force_refresh
-            # Force refresh: clear cache and fetch fresh
-            CacheAdapter.delete(cache_key)
-          end
+          CacheAdapter.delete(cache_key) if force_refresh
 
-          if cache_ttl.nil?
-            # Manual rotation: cache forever, only rotate on errors if rotate_on_errors is enabled
-            begin
-              CacheAdapter.fetch(cache_key, expires_in: nil) do
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              end
-            rescue KeyRelatedError => e
-              # Rotate on key-related errors if configured
-              if rotate_on_errors
-                OmniauthOpenidFederation::Logger.warn("[Jwks::Fetch] Key-related error detected, rotating cache: #{e.message}")
-                CacheAdapter.delete(cache_key)
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              else
-                raise
-              end
-            end
-          else
-            # TTL-based cache: expires after cache_ttl seconds
-            # Rotate on errors if configured
-            begin
-              CacheAdapter.fetch(cache_key, expires_in: cache_ttl) do
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              end
-            rescue KeyRelatedError => e
-              # Rotate on key-related errors if configured
-              if rotate_on_errors
-                OmniauthOpenidFederation::Logger.warn("[Jwks::Fetch] Key-related error detected, rotating cache: #{e.message}")
-                CacheAdapter.delete(cache_key)
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              else
-                raise
-              end
-            end
+          fetch_from_cache(cache_key, cache_ttl: cache_ttl, rotate_on_errors: rotate_on_errors) do
+            fetch_jwks(jwks_uri, entity_statement_keys)
           end
         else
           fetch_jwks(jwks_uri, entity_statement_keys)
         end
       end
 
+      def self.fetch_from_cache(cache_key, cache_ttl:, rotate_on_errors:)
+        CacheAdapter.fetch(cache_key, expires_in: cache_ttl) { yield }
+      rescue KeyRelatedError => error
+        if rotate_on_errors
+          OmniauthOpenidFederation::Logger.warn("[Jwks::Fetch] Key-related error detected, rotating cache: #{error.message}")
+          CacheAdapter.delete(cache_key)
+          yield
+        else
+          raise
+        end
+      end
+      private_class_method :fetch_from_cache
+
       def self.fetch_jwks(jwks_uri, entity_statement_keys)
         # Rate limiting to prevent DoS
         unless RateLimiter.allow?(jwks_uri)

data/lib/omniauth_openid_federation/jws.rb

@@ -1,5 +1,4 @@
 require "jwt"
-require "jwe"
 require "securerandom"
 require "base64"
 require_relative "string_helpers"
@@ -56,10 +55,6 @@ module OmniauthOpenidFederation
   #   )
   #   signed_jwt = jws.sign
   class Jws
-    # Request object expiration constants
-    REQUEST_OBJECT_EXPIRATION_SECONDS = 600 # 10 minutes in seconds
-    REQUEST_OBJECT_EXPIRATION_MINUTES = 10
-
     # State generation constants
     STATE_BYTES = 16 # Number of hex bytes for state parameter
 
@@ -223,7 +218,7 @@ module OmniauthOpenidFederation
         response_type: @response_type,
         scope: @scope,
         state: state,
-        exp: (TimeHelpers.now + (defined?(ActiveSupport) ? REQUEST_OBJECT_EXPIRATION_MINUTES.minutes : REQUEST_OBJECT_EXPIRATION_SECONDS)).to_i,
+        exp: (TimeHelpers.now + TimeHelpers.request_object_expiration_offset).to_i,
         jti: SecureRandom.uuid # JWT ID to prevent replay
       }
 
@@ -393,11 +388,7 @@ module OmniauthOpenidFederation
         # Convert JWK to OpenSSL public key
         public_key = KeyExtractor.jwk_to_openssl_key(encryption_key_data)
 
-        # Encrypt the signed JWT using JWE gem
-        # For JWE, we encrypt the signed JWT string as plaintext
-        # The pattern is: sign first, then encrypt (nested JWT)
-        # JWE.encrypt(plaintext, key, alg: "RSA-OAEP", enc: "A128CBC-HS256")
-        JWE.encrypt(
+        OmniauthOpenidFederation::Jwe.encrypt(
           signed_jwt,
           public_key,
           alg: encryption_alg,

data/lib/omniauth_openid_federation/jwt_response_decoder.rb

@@ -0,0 +1,288 @@
+require "base64"
+require "json"
+require "jwt"
+require "uri"
+
+require_relative "string_helpers"
+require_relative "logger"
+require_relative "validators"
+require_relative "utils"
+require_relative "key_extractor"
+require_relative "jwe"
+require_relative "jwks/decode"
+require_relative "federation/entity_statement"
+require_relative "federation/entity_statement_helper"
+require_relative "federation/signed_jwks"
+
+module OmniauthOpenidFederation
+  # Decrypts and verifies compact JWE/JWS response bodies (nested JWTs).
+  class JwtResponseDecoder
+    COMPACT_TOKEN_PATTERN = /\A[\w\-.]+\z/
+
+    def initialize(strategy_options:, client: nil)
+      @strategy_options = strategy_options
+      @client = client
+    end
+
+    def decode(body)
+      body_text = body.to_s.strip
+      return {} if OmniauthOpenidFederation::StringHelpers.blank?(body_text)
+
+      unless compact_token?(body_text)
+        return OmniauthOpenidFederation::Utils.to_indifferent_hash(JSON.parse(body_text))
+      end
+
+      signed_jwt = resolve_signed_jwt(body_text)
+      return OmniauthOpenidFederation::Utils.to_indifferent_hash(signed_jwt) if signed_jwt.is_a?(Hash)
+
+      payload = verify_signed_jwt(signed_jwt)
+      OmniauthOpenidFederation::Utils.to_indifferent_hash(payload)
+    end
+
+    private
+
+    def compact_token?(body_text)
+      COMPACT_TOKEN_PATTERN.match?(body_text) && body_text.count(".") >= 2
+    end
+
+    def resolve_signed_jwt(body_text)
+      if OmniauthOpenidFederation::Jwe.encrypted?(body_text)
+        plain_text = OmniauthOpenidFederation::Jwe.decrypt(body_text, encryption_key)
+        return plain_text if plain_text.to_s.split(".").length == 3
+
+        begin
+          parsed = JSON.parse(plain_text)
+          return parsed if parsed.is_a?(Hash)
+        rescue JSON::ParserError
+          # fall through to JWT verification path
+        end
+
+        plain_text
+      else
+        body_text
+      end
+    end
+
+    def verify_signed_jwt(signed_jwt)
+      parts = signed_jwt.to_s.split(".")
+      raise ValidationError, "Signed response is not a valid JWT" if parts.empty?
+
+      header = JSON.parse(Base64.urlsafe_decode64(parts.first))
+      algorithm = header["alg"] || header[:alg]
+
+      if algorithm.nil? || algorithm.to_s.downcase == "none"
+        raise ValidationError, "JWT algorithm '#{algorithm}' is not permitted for signed responses"
+      end
+
+      unless parts.length == 3
+        raise ValidationError, "Signed response is not a valid JWT"
+      end
+
+      normalized_strategy_options = OmniauthOpenidFederation::Validators.normalize_hash(@strategy_options)
+      signed_jwks = fetch_signed_jwks(normalized_strategy_options)
+
+      if signed_jwks
+        payload, = ::JWT.decode(
+          signed_jwt,
+          nil,
+          true,
+          {algorithms: [algorithm], jwks: signed_jwks}
+        )
+        return payload
+      end
+
+      jwks_uri = resolve_jwks_uri(normalized_strategy_options)
+      unless jwks_uri
+        raise ConfigurationError,
+          "JWKS URI not available. Cannot verify JWT signature. Provide jwks_uri in client_options or entity statement."
+      end
+
+      entity_statement_keys = load_entity_statement_keys_for_jwks_validation(normalized_strategy_options)
+      payload, = OmniauthOpenidFederation::Jwks::Decode.jwt(
+        signed_jwt,
+        jwks_uri.to_s,
+        entity_statement_keys: entity_statement_keys
+      )
+      payload
+    rescue ConfigurationError, ValidationError, SignatureError
+      raise
+    rescue => error
+      raise ValidationError, "Failed to verify JWT response: #{error.class} - #{error.message}", error.backtrace
+    end
+
+    def encryption_key
+      raw_client_options = @strategy_options[:client_options] || @strategy_options["client_options"] || {}
+      client_options = OmniauthOpenidFederation::Validators.normalize_hash(raw_client_options)
+
+      private_key = client_options[:private_key] ||
+        ((@client.respond_to?(:private_key) ? @client.private_key : nil))
+      jwks = client_options[:jwks] || client_options["jwks"]
+
+      metadata = nil
+      entity_statement_path = @strategy_options[:entity_statement_path] || @strategy_options["entity_statement_path"]
+      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
+        begin
+          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
+            entity_statement_path,
+            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
+          )
+          metadata = JSON.parse(File.read(validated_path)) if File.exist?(validated_path)
+        rescue => error
+          OmniauthOpenidFederation::Logger.debug("[JwtResponseDecoder] Could not load metadata for key extraction: #{error.message}")
+        end
+      end
+
+      key = OmniauthOpenidFederation::KeyExtractor.extract_encryption_key(
+        jwks: jwks,
+        metadata: metadata,
+        private_key: private_key
+      ) || private_key
+
+      OmniauthOpenidFederation::Validators.validate_private_key!(key)
+      key
+    end
+
+    def resolve_jwks_uri(strategy_options)
+      raw_client_options = strategy_options[:client_options] || strategy_options["client_options"] || {}
+      client_options = OmniauthOpenidFederation::Validators.normalize_hash(raw_client_options)
+      jwks_uri_value = client_options[:jwks_uri] ||
+        ((@client.respond_to?(:jwks_uri) ? @client.jwks_uri : nil))
+
+      if jwks_uri_value && %r{https?://.+}.match?(jwks_uri_value.to_s)
+        return URI.parse(jwks_uri_value.to_s)
+      end
+
+      if jwks_uri_value
+        return URI::HTTPS.build(
+          host: client_options[:host] || ((@client.respond_to?(:host) ? @client.host : nil)),
+          path: jwks_uri_value.to_s
+        )
+      end
+
+      remote_uri = resolve_jwks_uri_from_entity_statement(strategy_options)
+      remote_uri ? URI.parse(remote_uri.to_s) : nil
+    end
+
+    def fetch_signed_jwks(strategy_options)
+      entity_statement_content = load_entity_statement_content(strategy_options)
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
+
+      parsed = OmniauthOpenidFederation::Federation::EntityStatementHelper.parse_for_signed_jwks_from_content(
+        entity_statement_content
+      )
+      return nil if parsed.nil?
+
+      signed_jwks_uri = parsed[:signed_jwks_uri]
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(signed_jwks_uri)
+
+      OmniauthOpenidFederation::Federation::SignedJWKS.fetch!(signed_jwks_uri, parsed[:entity_jwks])
+    rescue OmniauthOpenidFederation::SecurityError, OmniauthOpenidFederation::ValidationError,
+      OmniauthOpenidFederation::FetchError => error
+      OmniauthOpenidFederation::Logger.error("[JwtResponseDecoder] Signed JWKS failure (fail closed): #{error.message}")
+      raise
+    end
+
+    def load_entity_statement_keys_for_jwks_validation(strategy_options)
+      entity_statement_content = load_entity_statement_content(strategy_options)
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
+
+      entity_statement = OmniauthOpenidFederation::Federation::EntityStatement.new(entity_statement_content)
+      parsed = entity_statement.parse
+      entity_jwks = parsed[:jwks] if parsed
+
+      keys = if entity_jwks.is_a?(Hash) && entity_jwks.key?("keys")
+        entity_jwks["keys"]
+      elsif entity_jwks.is_a?(Hash) && entity_jwks.key?(:keys)
+        entity_jwks[:keys]
+      elsif entity_jwks.is_a?(Array)
+        entity_jwks
+      else
+        []
+      end
+      if keys.empty?
+        OmniauthOpenidFederation::Logger.warn("[JwtResponseDecoder] No keys found in entity statement")
+        return nil
+      end
+
+      OmniauthOpenidFederation::Utils.to_indifferent_hash(
+        keys: keys.map { |jwk| jwk.is_a?(Hash) ? jwk : JSON.parse(jwk.to_json) }
+      )
+    rescue => error
+      OmniauthOpenidFederation::Logger.error(
+        "[JwtResponseDecoder] Failed to load entity statement keys for JWKS validation: #{error.message}"
+      )
+      nil
+    end
+
+    def resolve_jwks_uri_from_entity_statement(strategy_options)
+      entity_statement_content = load_entity_statement_content(strategy_options, log_fetch_errors: :debug)
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
+
+      entity_statement = OmniauthOpenidFederation::Federation::EntityStatement.new(entity_statement_content)
+      parsed = entity_statement.parse
+      return nil unless parsed
+
+      jwks_uri = parsed.dig(:metadata, :openid_provider, :jwks_uri) ||
+        parsed.dig("metadata", "openid_provider", "jwks_uri")
+      OmniauthOpenidFederation::StringHelpers.present?(jwks_uri) ? jwks_uri : nil
+    rescue => error
+      OmniauthOpenidFederation::Logger.debug(
+        "[JwtResponseDecoder] Could not extract JWKS URI from entity statement: #{error.message}"
+      )
+      nil
+    end
+
+    def load_entity_statement_content(strategy_options, log_fetch_errors: :warn)
+      normalized_options = OmniauthOpenidFederation::Validators.normalize_hash(strategy_options)
+      entity_statement_path = normalized_options[:entity_statement_path]
+      entity_statement_url = normalized_options[:entity_statement_url]
+      issuer = normalized_options[:issuer]
+      entity_statement_fingerprint = normalized_options[:entity_statement_fingerprint]
+
+      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
+        begin
+          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
+            entity_statement_path,
+            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
+          )
+          return File.read(validated_path) if File.exist?(validated_path)
+        rescue OmniauthOpenidFederation::SecurityError => error
+          OmniauthOpenidFederation::Logger.error("[JwtResponseDecoder] #{error.message}")
+        end
+      end
+
+      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_url)
+        begin
+          return OmniauthOpenidFederation::Federation::EntityStatement.fetch!(
+            entity_statement_url,
+            fingerprint: entity_statement_fingerprint
+          ).entity_statement
+        rescue => error
+          log_entity_statement_fetch_failure(log_fetch_errors, "URL", error)
+        end
+      end
+
+      if OmniauthOpenidFederation::StringHelpers.present?(issuer)
+        begin
+          return OmniauthOpenidFederation::Federation::EntityStatement.fetch_from_issuer!(
+            issuer,
+            fingerprint: entity_statement_fingerprint
+          ).entity_statement
+        rescue => error
+          log_entity_statement_fetch_failure(log_fetch_errors, "issuer", error)
+        end
+      end
+
+      nil
+    end
+
+    def log_entity_statement_fetch_failure(level, source, error)
+      message = "[JwtResponseDecoder] Failed to fetch entity statement from #{source}: #{error.message}"
+      if level == :debug
+        OmniauthOpenidFederation::Logger.debug(message)
+      else
+        OmniauthOpenidFederation::Logger.warn(message)
+      end
+    end
+  end
+end

data/lib/omniauth_openid_federation/oidc_client.rb

@@ -0,0 +1,101 @@
+require "oauth2"
+require "jwt"
+require "securerandom"
+require "uri"
+
+require_relative "errors"
+require_relative "access_token"
+
+module OmniauthOpenidFederation
+  class OidcClient < OAuth2::Client
+    CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+    CLIENT_ASSERTION_EXPIRATION_SECONDS = 180
+
+    attr_accessor :private_key, :authorization_code, :jwks_uri
+    attr_reader :authorization_endpoint, :token_endpoint, :userinfo_endpoint
+
+    def initialize(identifier:, redirect_uri:, authorization_endpoint:, token_endpoint:, secret: nil,
+      userinfo_endpoint: nil, jwks_uri: nil)
+      token_uri = URI.parse(token_endpoint.to_s)
+      site = build_site(token_uri)
+
+      super(
+        identifier,
+        secret,
+        site: site,
+        authorize_url: authorization_endpoint,
+        token_url: token_endpoint,
+        redirect_uri: redirect_uri,
+        auth_scheme: :private_key_jwt
+      )
+
+      @authorization_endpoint = authorization_endpoint
+      @token_endpoint = token_endpoint
+      @userinfo_endpoint = userinfo_endpoint
+      @jwks_uri = jwks_uri
+      @authorization_code = nil
+    end
+
+    def identifier
+      id
+    end
+
+    def identifier=(value)
+      @id = value
+    end
+
+    def redirect_uri
+      options[:redirect_uri]
+    end
+
+    def redirect_uri=(value)
+      options[:redirect_uri] = value
+    end
+
+    def host
+      URI.parse(site.to_s).host
+    end
+
+    def access_token!(client_auth_method = :jwt_bearer)
+      unless client_auth_method == :jwt_bearer
+        raise ConfigurationError, "Unsupported client_auth_method: #{client_auth_method}"
+      end
+
+      OmniauthOpenidFederation::Validators.validate_private_key!(private_key)
+
+      oauth_token = auth_code.get_token(
+        authorization_code,
+        redirect_uri: redirect_uri,
+        client_assertion_type: CLIENT_ASSERTION_TYPE,
+        client_assertion: build_client_assertion
+      )
+
+      OmniauthOpenidFederation::AccessToken.from_oauth2_token(
+        oauth_token,
+        strategy_options: instance_variable_get(:@strategy_options)
+      )
+    end
+
+    private
+
+    def build_site(token_uri)
+      site = "#{token_uri.scheme}://#{token_uri.host}"
+      site += ":#{token_uri.port}" if token_uri.port && !token_uri.default_port
+      site
+    end
+
+    def build_client_assertion
+      now = Time.now.to_i
+      payload = {
+        iss: identifier,
+        sub: identifier,
+        aud: token_endpoint.to_s,
+        jti: SecureRandom.hex(16),
+        iat: now,
+        exp: now + CLIENT_ASSERTION_EXPIRATION_SECONDS
+      }
+
+      JWT.encode(payload, private_key, "RS256")
+    end
+  end
+end

data/lib/omniauth_openid_federation/rack.rb

@@ -0,0 +1,2 @@
+require "rack"
+require_relative "rack_endpoint"

data/lib/omniauth_openid_federation/rack_endpoint.rb

@@ -88,7 +88,7 @@ module OmniauthOpenidFederation
       jwks_to_serve = OmniauthOpenidFederation::FederationEndpoint.current_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:jwks:#{Digest::SHA256.hexdigest(jwks_to_serve.to_json)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       jwks_json = if CacheAdapter.available?
@@ -159,7 +159,7 @@ module OmniauthOpenidFederation
       signed_jwks_jwt = OmniauthOpenidFederation::FederationEndpoint.generate_signed_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks_jwt)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       cached_jwt = if CacheAdapter.available?

data/lib/omniauth_openid_federation/rate_limiter.rb

@@ -1,4 +1,5 @@
 require "digest"
+require_relative "cache_adapter"
 require_relative "utils"
 require_relative "logger"
 
@@ -11,34 +12,30 @@ module OmniauthOpenidFederation
 
     # Check if request should be throttled
     #
+    # Best-effort only: read-modify-write on the cache adapter is not atomic, so parallel
+    # workers can briefly exceed the limit. Treat this as a DoS soft guard, not a hard quota.
+    #
     # @param key [String] Unique identifier for the rate limit (e.g., jwks_uri)
     # @param max_requests [Integer] Maximum requests allowed in window (default: 10)
     # @param window [Integer] Time window in seconds (default: 60)
     # @return [Boolean] true if request should be allowed, false if throttled
     def self.allow?(key, max_requests: DEFAULT_MAX_REQUESTS, window: DEFAULT_WINDOW_SECONDS)
-      return true unless defined?(Rails) && Rails.cache
+      return true unless CacheAdapter.available?
 
       cache_key = "omniauth_openid_federation:rate_limit:#{Digest::SHA256.hexdigest(key)}"
       current_time = Time.now.to_i
       window_start = current_time - window
 
-      # Get existing request timestamps
-      timestamps = Rails.cache.read(cache_key) || []
-
-      # Filter out timestamps outside the current window
+      timestamps = CacheAdapter.read(cache_key) || []
       timestamps = timestamps.select { |ts| ts > window_start }
 
-      # Check if we've exceeded the limit
       if timestamps.length >= max_requests
         OmniauthOpenidFederation::Logger.warn("[RateLimiter] Rate limit exceeded for #{Utils.sanitize_uri(key)}: #{timestamps.length}/#{max_requests} requests in #{window}s")
         return false
       end
 
-      # Add current request timestamp
       timestamps << current_time
-
-      # Store updated timestamps (expires after window)
-      Rails.cache.write(cache_key, timestamps, expires_in: window)
+      CacheAdapter.write(cache_key, timestamps, expires_in: window)
 
       true
     end
@@ -47,9 +44,10 @@ module OmniauthOpenidFederation
     #
     # @param key [String] Unique identifier for the rate limit
     def self.reset!(key)
-      return unless defined?(Rails) && Rails.cache
+      return unless CacheAdapter.available?
+
       cache_key = "omniauth_openid_federation:rate_limit:#{Digest::SHA256.hexdigest(key)}"
-      Rails.cache.delete(cache_key)
+      CacheAdapter.delete(cache_key)
     end
   end
 end

data/lib/omniauth_openid_federation/secure_compare.rb

@@ -0,0 +1,15 @@
+require "openssl"
+
+module OmniauthOpenidFederation
+  module SecureCompare
+    module_function
+
+    def secure_compare(left, right)
+      left = left.to_s
+      right = right.to_s
+      return false unless left.bytesize == right.bytesize
+
+      OpenSSL.fixed_length_secure_compare(left, right)
+    end
+  end
+end