rodauth-oauth 1.6.5 → 1.6.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc6a614c797762b13c8b97dc51abf5191dc09ef919e27fd394f46504b62410c7
-  data.tar.gz: 3c6003d4131e03514a5bf8acd674cc1b7d8fcacd9eada7ab98044fc3f037fc95
+  metadata.gz: d114c188d7d68d73ec35837c57c6491022be90288a56aecc7dd61b26949d2509
+  data.tar.gz: d6d55020809cc6397d23b00f85b89fd948e0b79ffd7970a1956b1b938419ad3d
 SHA512:
-  metadata.gz: 997c1e682fc4f482d0ea367a918c4db15130535294db13f19c52c558f152eca78fd197461d74ce269e77a56b36cf465b8b7e9d2424f3b999cb6491782c8d69f6
-  data.tar.gz: 2109d08b8911e33697e08e528899d45535de16c1cc994d663324c51161fed1f6e35386849413adb6dadbb526b2b75c64522865cbdf90798042ca8e68767362cf
+  metadata.gz: 546dd06b480c261c6818a7852cb85c4366011631190c4ee749ef59e33a8cb11b3fd1fedca8e7a7bf79e100f1ee406a3f8e71a895e1b0e4fe66abc63d0ba83efa
+  data.tar.gz: 8239900aebd23ba93d91311a06bb66d88a0a732d70772bc6ef6b0b21d01c91225e1cdc5b76d0a14de3400aa3fd02cbb7d0a406ed2b9a43693f5008d4563c40e5

data/README.md

@@ -183,7 +183,15 @@ If you're starting from scratch though, the recommendation is to stick to the de
 
 You'll have to generate HTML templates for the Oauth Authorization form.
 
-The rodauth default setup expects the roda `render` plugin to be activated; by default, it expects a `views` directory to be defined in the project root folder. The Oauth Authorization template must be therefore defined there, and it should be called `oauth_authorize.(erb|str|...)` (read the [roda `render` plugin documentation](http://roda.jeremyevans.net/rdoc/classes/Roda/RodaPlugins/Render.html) for more info about HTML templating).
+The rodauth default setup expects the roda `render` plugin to be activated; by default, it expects a `views` directory to be defined in the project root folder. The Oauth Authorization template must be therefore defined there, and it should be called `authorize.(erb|str|...)` (read the [roda `render` plugin documentation](http://roda.jeremyevans.net/rdoc/classes/Roda/RodaPlugins/Render.html) for more info about HTML templating).
+
+Start it from [the bundled template](templates/authorize.str), which is written for the `str` engine, rather than from a blank file:
+
+```
+cp "$(bundle info rodauth-oauth --path)/templates/authorize.str" views/authorize.str
+```
+
+The form posts back to the authorize endpoint, so every authorization request parameter the grant depends on has to be carried over into it. A parameter left out is dropped from the grant silently, and only surfaces later as an error at the token endpoint, which is why adapting the bundled template beats writing one from scratch. See [the authorize form docs](doc/oauth_authorize_base.rdoc) for the parts which are easiest to lose.
 
 ### OAuth applications management
 

data/doc/release_notes/1_6_6.md

@@ -0,0 +1,25 @@
+### 1.6.6
+
+#### Improvements
+
+* Authorization form params will now be exposed to the HTML rendering via the `rodauth.authorize_form_params`; this not only reduces the size of the bundled forms, but also makes it much easier to add or remove features with their own required authorize params.
+* `:oauth_jwt_base` feature: new `:oauth_jwt_iat_leeway` option (defaults to 30, as in seconds), is used now to make the JWT claim `iat` claim tolerant to clock skew. This option is used in both the `jwt` and `json/jwt` gem integrations.
+* `:oauth_pkce` feature: new `:oauth_pkce_allow_plain_method` option, which may disallow the usage of `"plain"` as a PKCE challenge method
+  * defaults to `true` in order not to break backwards compatibility, but this is going to change in a future version, so you are recommended to set it explicitly in order not to break your application in a future upgrade.
+
+#### Bugfixes
+
+* (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was incorrectly authenticating the request (responding with 200 when secret didn't match), thereby allowing anyone (else) to update application parameters.
+* (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was not hashing the client secret when hashing on the client secret was enforced.
+* `:oauth_authorization_code_grant` feature: escape untrusted values in the authorize form (hidden request params, the `"state"` in the cancel link, the client application name), in the authorize form post  POST response form, and in the device verification template.
+* token endpoint: enforce 4XX HTTP responses with JSON encoded body when there are errors (instead of making it rely on the "accept" HTTP header).
+* client authentication: fallback to `oauth_default_token_endpoint_auth_methods` when the application being authentication has no `token_endpoint_auth_method` set (instead of assuming it as "none").
+* `:oauth_dynamic_client_registration` feature: client metadata which the server does not understand is now ignored (RFC 7591 section 3.1), instead of failing the registration with an `"invalid_client_metadata"` error.
+* `:oauth_dynamic_client_registration` feature: fix typo which was exposing `client_secret` in the registration response in cases where it shouldn't.
+* `:oauth_dynamic_client_registration` feature: emit `"client_id_issued_at"` as epoch seconds instead of an ISO8601 string, as per [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1).
+* `:oauth_dynamic_client_registration` feature: remove "registration_access_token" and "registration_client_uri" parameters from the payload (these are only valid for the OIDC counterpart).
+* `json/jwt`: decoding a JWT was bypassing claims verification.
+
+#### Security
+
+* Using `rodauth` `timing_safe_eql?` helper method, a string comparison function which is safe against timing attacks, in client secret matching and PKCE verification.

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/authorize.html.erb

@@ -3,7 +3,7 @@
     <%= image_tag rodauth.oauth_application[rodauth.oauth_applications_logo_uri_column] %>
   <% end %>
   <% application_uri = rodauth.oauth_application[rodauth.oauth_applications_homepage_url_column] %>
-  <% application_name = application_uri ? link_to(rodauth.oauth_application[rodauth.oauth_applications_name_column], application_uri) : rodauth.oauth_application[rodauth.oauth_applications_name_column] %>
+  <% application_name = application_uri ? link_to(rodauth.oauth_application[rodauth.oauth_applications_name_column], application_uri) : h(rodauth.oauth_application[rodauth.oauth_applications_name_column]) %>
   <p class="lead"><%= rodauth.authorize_page_lead(name: application_name).html_safe %></p>
 
   <div class="list-group">
@@ -37,56 +37,14 @@
         </div>
       <% end %>
     <% end %>
-    <%= hidden_field_tag :client_id, rodauth.param_or_nil("client_id") %>
-    <% %w[access_type response_type response_mode state redirect_uri].each do |oauth_param| %>
-      <% if rodauth.param_or_nil(oauth_param) %>
-        <%= hidden_field_tag oauth_param, rodauth.param_or_nil(oauth_param) %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oauth_resource_indicators) && rodauth.resource_indicators %>
-      <% rodauth.resource_indicators.each do |resource| %>
-        <%= hidden_field_tag "resource", resource %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oauth_pkce) %>
-      <% if rodauth.param_or_nil("code_challenge") %>
-        <%= hidden_field_tag :code_challenge, rodauth.param_or_nil("code_challenge") %>
-      <% end %>
-      <% if rodauth.param_or_nil("code_challenge_method") %>
-        <%= hidden_field_tag :code_challenge_method, rodauth.param_or_nil("code_challenge_method") %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oidc) %>
-      <% if rodauth.param_or_nil("prompt") %>
-        <%= hidden_field_tag :prompt, rodauth.param_or_nil("prompt") %>
-      <% end %>
-      <% if rodauth.param_or_nil("nonce") %>
-        <%= hidden_field_tag :nonce, rodauth.param_or_nil("nonce") %>
-      <% end %>
-      <% if rodauth.param_or_nil("ui_locales") %>
-        <%= hidden_field_tag :ui_locales, rodauth.param_or_nil("ui_locales") %>
-      <% end %>
-      <% if rodauth.param_or_nil("claims_locales") %>
-        <%= hidden_field_tag :claims_locales, rodauth.param_or_nil("claims_locales") %>
-      <% end %>
-      <% if rodauth.param_or_nil("claims") %>
-        <%= hidden_field_tag :claims, sanitize(rodauth.param_or_nil("claims")) %>
-      <% end %>
-      <% if rodauth.param_or_nil("acr_values") %>
-        <%= hidden_field_tag :acr_values, rodauth.param_or_nil("acr_values") %>
-      <% end %>
-      <% if rodauth.param_or_nil("registration") %>
-        <%= hidden_field_tag :registration, rodauth.param_or_nil("registration") %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oauth_dpop) %>
-      <% if rodauth.param_or_nil("dpop_jkt") %>
-        <%= hidden_field_tag :dpop_jkt, rodauth.param_or_nil("dpop_jkt") %>
-      <% end %>
+    <% rodauth.authorize_form_params.each do |field| %>
+      <%= tag(:input, type: field["type"], name: field["name"], value: field["value"]) %>
     <% end %>
   </div>
  <p class="text-center">
     <%= submit_tag rodauth.oauth_authorize_button, class: "btn btn-outline-primary" %>
-    <%= link_to rodauth.oauth_cancel_button, "#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{"&state=\#{CGI.escape(rodauth.state)}" if rodauth.param_or_nil("state") }", class: "btn btn-outline-danger" %>
+    <% cancel_url = "#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request" %>
+    <% cancel_url += "&state=#{CGI.escape(rodauth.param("state"))}" if rodauth.param_or_nil("state") %>
+    <%= link_to rodauth.oauth_cancel_button, cancel_url, class: "btn btn-outline-danger" %>
   </p>
 <% end %>

data/lib/rodauth/features/oauth_authorization_code_grant.rb

@@ -116,7 +116,7 @@ module Rodauth
         <html>
           <head><title>Authorized</title></head>
           <body onload="javascript:document.forms[0].submit()">
-            <form method="post" action="#{url}">
+            <form method="post" action="#{scope.h(url)}">
               #{yield}
               <input type="submit" class="btn btn-outline-primary" value="#{scope.h(oauth_authorize_post_button)}"/>
             </form>
@@ -130,7 +130,7 @@ module Rodauth
         <html>
           <head><title></title></head>
           <body onload="javascript:document.forms[0].submit()">
-            <form method="post" action="#{url}">
+            <form method="post" action="#{scope.h(url)}">
               #{yield}
             </form>
           </body>

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -30,7 +30,8 @@ module Rodauth
 
     auth_methods(
       :resource_owner_params,
-      :oauth_grants_resource_owner_columns
+      :oauth_grants_resource_owner_columns,
+      :authorize_form_params
     )
 
     OAUTH_ACCESS_TYPES = %w[offline online].freeze
@@ -73,6 +74,24 @@ module Rodauth
       end
     end
 
+    # The authorization request is validated on the GET which renders the form, and again on the
+    # POST which the resource owner submits, and the latter is a fresh request. These are the
+    # params of the authorization request which the form has to carry over into it, one entry per
+    # field, each with the "name", "value" and "type" it is rendered with. Features which introduce
+    # authorization request params of their own extend it, so a view which renders all of them
+    # keeps working as features get enabled.
+    def authorize_form_params
+      params = [{ "name" => "client_id", "value" => param("client_id"), "type" => "hidden" }]
+
+      %w[access_type response_type response_mode state redirect_uri].each do |param_name|
+        if (param_value = param_or_nil(param_name))
+          params << { "name" => param_name, "value" => param_value, "type" => "hidden" }
+        end
+      end
+
+      params
+    end
+
     private
 
     def validate_authorize_params

data/lib/rodauth/features/oauth_base.rb

@@ -34,6 +34,15 @@ module Rodauth
     auth_value_method :oauth_unique_id_generation_retries, 3
 
     auth_value_method :oauth_token_endpoint_auth_methods_supported, %w[client_secret_basic client_secret_post]
+    # An application which has no auth method of its own falls back to these, and not to every
+    # method the server supports: enabling a new method server-wide (such as "none", which requires
+    # no client authentication at all) must not turn existing confidential clients into public ones.
+    #
+    # TODO: change this to "client_secret_basic" only in a future major version, as per
+    # https://datatracker.ietf.org/doc/html/rfc7591#section-2, which defaults an omitted
+    # "token_endpoint_auth_method" to it. Doing so now would lock out "client_secret_post" clients
+    # whose application row has no auth method set.
+    auth_value_method :oauth_default_token_endpoint_auth_methods, %w[client_secret_basic client_secret_post]
     auth_value_method :oauth_grant_types_supported, %w[refresh_token]
     auth_value_method :oauth_response_types_supported, []
     auth_value_method :oauth_response_modes_supported, []
@@ -188,6 +197,11 @@ module Rodauth
     def accepts_json?
       return true if only_json?
 
+      # the token endpoint responds in json no matter what the client asks for, including its
+      # errors, which are never bounced off the client's redirect uri.
+      # https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+      return true if request.path == token_path
+
       (accept = request.env["HTTP_ACCEPT"]) && accept =~ json_request_regexp
     end
 
@@ -404,10 +418,10 @@ module Rodauth
     def supports_auth_method?(oauth_application, auth_method)
       return false unless oauth_application
 
-      supported_auth_methods = if oauth_application[oauth_applications_token_endpoint_auth_method_column]
-                                 oauth_application[oauth_applications_token_endpoint_auth_method_column].split(/ +/)
+      supported_auth_methods = if (auth_methods = oauth_application[oauth_applications_token_endpoint_auth_method_column])
+                                 auth_methods.split(/ +/)
                                else
-                                 oauth_token_endpoint_auth_methods_supported
+                                 oauth_default_token_endpoint_auth_methods
                                end
 
       supported_auth_methods.include?(auth_method)
@@ -431,7 +445,11 @@ module Rodauth
       if oauth_applications_client_secret_hash_column
         BCrypt::Password.new(oauth_application[oauth_applications_client_secret_hash_column]) == secret
       else
-        oauth_application[oauth_applications_client_secret_column] == secret
+        stored_secret = oauth_application[oauth_applications_client_secret_column]
+        # A missing submitted or stored secret must never match. Without these guards, .to_s would
+        # coerce nil to "", letting an absent secret authenticate a client whose stored secret is
+        # empty/NULL. The real comparison stays constant-time via timing_safe_eql?.
+        !secret.nil? && !stored_secret.nil? && timing_safe_eql?(secret.to_s, stored_secret.to_s)
       end
     end
 

data/lib/rodauth/features/oauth_dpop.rb

@@ -85,6 +85,14 @@ module Rodauth
       super
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        if (param_value = param_or_nil("dpop_jkt"))
+          params << { "name" => "dpop_jkt", "value" => param_value, "type" => "hidden" }
+        end
+      end
+    end
+
     private
 
     def validate_token_params

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -12,7 +12,12 @@ module Rodauth
     auth_value_method :oauth_applications_registration_access_token_column, :registration_access_token
     auth_value_method :registration_client_uri_route, "register"
 
-    PROTECTED_APPLICATION_ATTRIBUTES = %w[account_id client_id].freeze
+    PROTECTED_APPLICATION_CREATE_ATTRIBUTES = %w[account_id client_id].freeze
+
+    PROTECTED_APPLICATION_UPDATE_ATTRIBUTES = %w[account_id client_id registration_access_token registration_client_uri
+                                                 client_secret_expires_at client_id_issued_at].freeze
+
+    HIDDEN_APPLICATION_ATTRIBUTES = %w[id account_id client_id client_secret client_secret_hash].freeze
 
     def load_registration_client_uri_routes
       request.on(registration_client_uri_route) do
@@ -34,19 +39,14 @@ module Rodauth
               json_response_oauth_application(oauth_application)
             end
             request.on method: :put do
-              %w[client_id registration_access_token registration_client_uri client_secret_expires_at
-                 client_id_issued_at].each do |prohibited_param|
-                if request.params.key?(prohibited_param)
-                  register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(prohibited_param))
-                end
-              end
-              validate_client_registration_params
+              validate_client_registration_params(request.params, PROTECTED_APPLICATION_UPDATE_ATTRIBUTES)
 
-              # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
-              # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
-              # its own chosen value.
-              authorization_required if request.params.key?("client_secret") && secret_matches?(oauth_application,
-                                                                                                request.params["client_secret"])
+              if request.params.key?("client_secret") && !secret_matches?(oauth_application, request.params["client_secret"])
+                # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
+                # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
+                # its own chosen value.
+                authorization_required
+              end
 
               oauth_application = transaction do
                 applications_ds = db[oauth_applications_table]
@@ -80,7 +80,7 @@ module Rodauth
           end
         end
 
-        validate_client_registration_params
+        validate_client_registration_params(request.params, PROTECTED_APPLICATION_CREATE_ATTRIBUTES)
 
         response_params = transaction do
           before_register
@@ -119,8 +119,14 @@ module Rodauth
       }
     end
 
-    def validate_client_registration_params(request_params = request.params)
+    def validate_client_registration_params(request_params, protected_attributes = PROTECTED_APPLICATION_CREATE_ATTRIBUTES)
+      @oauth_application_unrecognized_params = []
       @oauth_application_params = request_params.each_with_object({}) do |(key, value), params|
+        if protected_attributes.include?(key)
+          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
+          next
+        end
+
         case key
         when "redirect_uris"
           if value.is_a?(Array)
@@ -179,6 +185,10 @@ module Rodauth
             end
           end
           key = __send__(:"oauth_applications_#{key}_column")
+        when "client_secret"
+          # use internal routine which may hash the secret
+          set_client_secret(params, value)
+          next
         when "jwks"
           register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(value)) unless value.is_a?(Hash)
           if request_params.key?("jwks_uri")
@@ -248,13 +258,14 @@ module Rodauth
           key = __send__(:"oauth_applications_#{key}_column")
         else
           if respond_to?(:"oauth_applications_#{key}_column")
-            if PROTECTED_APPLICATION_ATTRIBUTES.include?(key)
-              register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
-            end
             property = :"oauth_applications_#{key}_column"
             key = __send__(property)
           elsif !db[oauth_applications_table].columns.include?(key.to_sym)
-            register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
+            # https://datatracker.ietf.org/doc/html/rfc7591#section-3.1
+            # "The authorization server MUST ignore any client metadata sent by the client that it
+            # does not understand".
+            @oauth_application_unrecognized_params << key
+            next
           end
         end
         params[key] = value
@@ -285,6 +296,9 @@ module Rodauth
       applications_ds = db[oauth_applications_table]
       application_columns = applications_ds.columns
 
+      # ignored metadata is not part of the registration, so it does not belong in the response either
+      Array(@oauth_application_unrecognized_params).each { |key| return_params.delete(key) }
+
       # set defaults
       create_params = @oauth_application_params
 
@@ -311,7 +325,7 @@ module Rodauth
         "code"
       end
       rescue_from_uniqueness_error do
-        initialize_register_params(create_params, return_params)
+        initialize_create_params(create_params, return_params)
         create_params.delete_if { |k, _| !application_columns.include?(k) }
         applications_ds.insert(create_params)
       end
@@ -319,19 +333,15 @@ module Rodauth
       return_params
     end
 
-    def initialize_register_params(create_params, return_params)
+    def initialize_create_params(create_params, return_params)
       client_id = oauth_unique_id_generator
       create_params[oauth_applications_client_id_column] = client_id
       return_params["client_id"] = client_id
-      return_params["client_id_issued_at"] = Time.now.utc.iso8601
-
-      registration_access_token = oauth_unique_id_generator
-      create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)
-      return_params["registration_access_token"] = registration_access_token
-      return_params["registration_client_uri"] = "#{base_url}/#{registration_client_uri_route}/#{return_params['client_id']}"
+      # https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1
+      # "client_id_issued_at" is a number, expressed as seconds since 1970-01-01T00:00:00Z.
+      return_params["client_id_issued_at"] = Time.now.to_i
 
       if create_params.key?(oauth_applications_client_secret_column)
-        set_client_secret(create_params, create_params[oauth_applications_client_secret_column])
         return_params.delete("client_secret")
       else
         client_secret = oauth_unique_id_generator
@@ -404,7 +414,7 @@ module Rodauth
       params = methods.map { |k| k.to_s[/\Aoauth_applications_(\w+)_column\z/, 1] }.compact
 
       body = params.each_with_object({}) do |k, hash|
-        next if %w[id account_id client_id client_secret cliennt_secret_hash].include?(k)
+        next if HIDDEN_APPLICATION_ATTRIBUTES.include?(k)
 
         value = oauth_application[__send__(:"oauth_applications_#{k}_column")]
 

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -18,6 +18,11 @@ module Rodauth
 
     auth_value_method :oauth_jwt_jwe_copyright, nil
 
+    # Clock-skew leeway, in seconds, tolerated when rejecting a JWT whose iat (issued-at) is in the
+    # future. iat is informational per RFC 7519 section 4.1.6, so this only guards against tokens
+    # issued well ahead of now. Applies to the json-jwt verification path (see jwt_decode).
+    auth_value_method :oauth_jwt_iat_leeway, 30
+
     auth_methods(
       :jwt_encode,
       :jwt_decode,
@@ -266,15 +271,28 @@ module Rodauth
                  end
 
         now = Time.now
-        if verify_claims &&
-           (!claims[:exp] || Time.at(claims[:exp]) < now) &&
-           claims[:nbf] && Time.at(claims[:nbf]) < now &&
-           claims[:iat] && Time.at(claims[:iat]) < now &&
-           verify_iss && claims[:iss] != oauth_jwt_issuer &&
-           verify_aud && !verify_aud(claims[:aud], claims[:client_id]) &&
-           verify_jti && !verify_jti(claims[:jti], claims)
-
-          return
+        if verify_claims
+          # Each line asserts that a claim is acceptable: absent / not checked, or valid. The token
+          # is rejected unless all of them hold. These are deliberately PASS conditions joined with
+          # `&&` -- the inverse (failure conditions joined with `&&`) only rejects when every check
+          # fails at once, which was the original verification bug. exp/nbf/iat are optional and
+          # only enforced when present (e.g. DPoP proofs carry no exp).
+          #
+          # iat is informational per RFC 7519 section 4.1.6 (RFC 9068 section 4 requires it be present,
+          # not verified), so we only reject tokens issued in the future, tolerating
+          # oauth_jwt_iat_leeway seconds of clock skew. Both backends now honor oauth_jwt_iat_leeway:
+          # the ruby-jwt path disables verify_iat (which removed iat_leeway in 2.2.0, jwt/ruby-jwt#319)
+          # and performs the same leeway'd future-iat check manually, so behavior is unified.
+          # A non-numeric iat is malformed (NumericDate per RFC 7519); reject it rather than letting
+          # Time.at raise, mirroring the ruby-jwt path so both backends reject malformed iat alike.
+          claims_valid = (!claims[:exp] || Time.at(claims[:exp]) >= now) &&
+                         (!claims[:nbf] || Time.at(claims[:nbf]) <= now) &&
+                         (!claims[:iat] || (claims[:iat].is_a?(Numeric) && Time.at(claims[:iat]) <= now + oauth_jwt_iat_leeway)) &&
+                         (!verify_iss || claims[:iss] == oauth_jwt_issuer) &&
+                         (!verify_aud || verify_aud(claims[:aud], claims[:client_id])) &&
+                         (!verify_jti || verify_jti(claims[:jti], claims))
+
+          return unless claims_valid
         end
 
         return if verify_headers && !verify_headers.call(claims.header)
@@ -413,7 +431,12 @@ module Rodauth
         #
         # issuer: check that server generated the token
         # aud: check the audience field (client is who he says he is)
-        # iat: check that the token didn't expire
+        # exp: check that the token hasn't expired
+        # iat: informational per RFC 7519 section 4.1.6, so we only reject a future iat, tolerating
+        #      oauth_jwt_iat_leeway seconds of clock skew. ruby-jwt's verify_iat offers no leeway knob
+        #      (iat_leeway was removed in 2.2.0, jwt/ruby-jwt#319), so verify_iat is disabled below and
+        #      iat is checked manually -- unifying behavior with the json-jwt path, which honors the
+        #      same oauth_jwt_iat_leeway.
         #
         # subject can't be verified automatically without having access to the account id,
         # which we don't because that's the whole point.
@@ -425,7 +448,9 @@ module Rodauth
                                    # can't use stock aud verification, as it's dependent on the client application id
                                    verify_aud: false,
                                    verify_jti: (verify_jti ? method(:verify_jti) : false),
-                                   verify_iat: true
+                                   # iat is verified manually below (with leeway) rather than via
+                                   # ruby-jwt's verify_iat, which rejects a future iat with no leeway.
+                                   verify_iat: false
                                  }
                                else
                                  {}
@@ -456,6 +481,16 @@ module Rodauth
                             JWT.decode(token, nil, true, jwks: jwks, algorithms: algorithms, **verify_claims_params)
                           end
 
+        # iat is only rejected when issued in the future, tolerating oauth_jwt_iat_leeway seconds of
+        # clock skew -- mirroring the json-jwt path so both backends behave identically. ruby-jwt
+        # claims are string-keyed. Since verify_iat is disabled above, ruby-jwt no longer validates
+        # that iat is a NumericDate, so reject a non-numeric iat here rather than letting Time.at
+        # raise an error the JWT::DecodeError handler would not catch.
+        if verify_claims && (iat = claims["iat"])
+          return unless iat.is_a?(Numeric)
+          return if Time.at(iat) > Time.now + oauth_jwt_iat_leeway
+        end
+
         return if verify_claims && verify_aud && !verify_aud(claims["aud"], claims["client_id"])
 
         return if verify_headers && !verify_headers.call(headers)
@@ -496,7 +531,7 @@ module Rodauth
         JWT.decode(token, nil, false)
       end
     else
-      # :nocov:
+      # simplecov:enable
       def jwk_export(_key)
         raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
       end
@@ -520,7 +555,7 @@ module Rodauth
       def private_jwk?(_jwk)
         raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
       end
-      # :nocov:
+      # simplecov:disable
     end
   end
 end

data/lib/rodauth/features/oauth_pkce.rb

@@ -9,6 +9,11 @@ module Rodauth
     auth_value_method :oauth_require_pkce, true
     auth_value_method :oauth_pkce_challenge_method, "S256"
 
+    # TODO: change to false in a major version bump
+    # RFC 7636 §4.2 discourages the "plain" transform: it transmits the raw code_verifier,
+    # so an intercepted authorization request exposes it and defeats PKCE.
+    auth_value_method :oauth_pkce_allow_plain_method, true
+
     auth_value_method :oauth_grants_code_challenge_column, :code_challenge
     auth_value_method :oauth_grants_code_challenge_method_column, :code_challenge_method
 
@@ -17,6 +22,16 @@ module Rodauth
     auth_value_method :oauth_unsupported_transform_algorithm_error_code, "invalid_request"
     translatable_method :oauth_unsupported_transform_algorithm_message, "transform algorithm not supported"
 
+    def authorize_form_params
+      super.tap do |params|
+        %w[code_challenge code_challenge_method].each do |param_name|
+          if (param_value = param_or_nil(param_name))
+            params << { "name" => param_name, "value" => param_value, "type" => "hidden" }
+          end
+        end
+      end
+    end
+
     private
 
     def supports_auth_method?(oauth_application, auth_method)
@@ -61,7 +76,13 @@ module Rodauth
       if param_or_nil("code_challenge")
 
         challenge_method = param_or_nil("code_challenge_method")
-        redirect_response_error("code_challenge_required") unless oauth_pkce_challenge_method == challenge_method
+
+        # Reject the weak "plain" transform unless it has been explicitly opted into. This runs
+        # before the supported-method check so the disabled method surfaces a meaningful error
+        # instead of the generic "code challenge required".
+        redirect_response_error("unsupported_transform_algorithm") if challenge_method == "plain" && !oauth_pkce_allow_plain_method
+
+        redirect_response_error("code_challenge_required") unless oauth_pkce_challenge_methods.include?(challenge_method)
       else
         return unless oauth_require_pkce
 
@@ -74,19 +95,29 @@ module Rodauth
 
       case grant[oauth_grants_code_challenge_method_column]
       when "plain"
-        challenge == verifier
+        # A grant stored with the weak "plain" method must not be redeemable unless the
+        # method has been explicitly enabled, otherwise PKCE is silently downgraded.
+        redirect_response_error("unsupported_transform_algorithm") unless oauth_pkce_allow_plain_method
+        timing_safe_eql?(verifier.to_s, challenge.to_s)
       when "S256"
         generated_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
 
-        challenge == generated_challenge
+        timing_safe_eql?(generated_challenge, challenge.to_s)
       else
         redirect_response_error("unsupported_transform_algorithm")
       end
     end
 
+    # The PKCE transform methods the server accepts. "S256" is always supported; the weak "plain"
+    # transform is only included when explicitly opted into via oauth_pkce_allow_plain_method.
+    def oauth_pkce_challenge_methods
+      oauth_pkce_allow_plain_method ? %w[S256 plain] : %w[S256]
+    end
+
     def oauth_server_metadata_body(*)
       super.tap do |data|
-        data[:code_challenge_methods_supported] = oauth_pkce_challenge_method
+        # RFC 8414: code_challenge_methods_supported is a JSON array of the supported methods.
+        data[:code_challenge_methods_supported] = oauth_pkce_challenge_methods
       end
     end
   end

data/lib/rodauth/features/oauth_resource_indicators.rb

@@ -46,6 +46,15 @@ module Rodauth
       authorization_required unless token_indicators.any? { |resource| base_url.start_with?(resource) }
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        # the "resource" param may be repeated, so it carries one entry per resource indicator
+        Array(resource_indicators).each do |resource|
+          params << { "name" => "resource", "value" => resource, "type" => "hidden" }
+        end
+      end
+    end
+
     private
 
     def validate_token_params

data/lib/rodauth/features/oidc.rb

@@ -235,6 +235,16 @@ module Rodauth
       super unless subject_type == "pairwise"
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        %w[prompt nonce ui_locales claims_locales claims acr_values].each do |param_name|
+          if (param_value = param_or_nil(param_name))
+            params << { "name" => param_name, "value" => param_value, "type" => "hidden" }
+          end
+        end
+      end
+    end
+
     private
 
     if defined?(::I18n)

data/lib/rodauth/features/oidc_dynamic_client_registration.rb

@@ -287,7 +287,7 @@ module Rodauth
       "The application type '#{application_type}' is not allowed."
     end
 
-    def initialize_register_params(create_params, return_params)
+    def initialize_create_params(create_params, return_params)
       super
       registration_access_token = oauth_unique_id_generator
       create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)

data/lib/rodauth/features/oidc_frontchannel_logout.rb

@@ -2,10 +2,10 @@
 
 require "rodauth/oauth"
 
-# :nocov:
+# simplecov:enable
 raise LoadError, "the `:oidc_frontchannel_logout` requires rodauth 2.32.0 or higher" if Rodauth::VERSION < "2.32.0"
 
-# :nocov:
+# simplecov:disable
 
 module Rodauth
   Feature.define(:oidc_frontchannel_logout, :OidFrontchannelLogout) do

data/lib/rodauth/features/oidc_self_issued.rb

@@ -38,6 +38,14 @@ module Rodauth
       @oauth_application = client_params
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        if (param_value = param_or_nil("registration"))
+          params << { "name" => "registration", "value" => param_value, "type" => "hidden" }
+        end
+      end
+    end
+
     private
 
     def oauth_response_types_supported

data/lib/rodauth/oauth/ttl_store.rb

@@ -23,7 +23,7 @@ class Rodauth::OAuth::TtlStore
   def set(key, &block)
     @store_mutex.synchronize do
       # short circuit
-      return @store[key][:payload] if @store[key] && @store[key][:ttl] < now
+      return @store[key][:payload] if @store[key] && @store[key][:ttl] > now
     end
 
     payload, ttl = block.call
@@ -33,9 +33,9 @@ class Rodauth::OAuth::TtlStore
     @store_mutex.synchronize do
       # given that the block call triggers network, and two requests for the same key be processed
       # at the same time, this ensures the first one wins.
-      return @store[key][:payload] if @store[key] && @store[key][:ttl] < now
+      return @store[key][:payload] if @store[key] && @store[key][:ttl] > now
 
-      @store[key] = { payload: payload, ttl: ttl || (now + DEFAULT_TTL) }
+      @store[key] = { payload: payload, ttl: now + (ttl || DEFAULT_TTL) }
     end
     @store[key][:payload]
   end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.5"
+    VERSION = "1.6.6"
   end
 end

data/templates/authorize.str

@@ -10,7 +10,7 @@
   <p class="lead">
   #{
     application_uri = rodauth.oauth_application[rodauth.oauth_applications_homepage_url_column]
-    application_name = application_uri ? (<<-LINK) : rodauth.oauth_application[rodauth.oauth_applications_name_column]
+    application_name = application_uri ? (<<-LINK) : h(rodauth.oauth_application[rodauth.oauth_applications_name_column])
       <a target="_blank" href="#{h(application_uri)}">
         #{h(rodauth.oauth_application[rodauth.oauth_applications_name_column])}
       </a>
@@ -62,7 +62,7 @@
     #{
       rodauth.authorize_scopes.map do |scope|
         if rodauth.features.include?(:oidc) && scope == "offline_access"
-          "<input type=\"hidden\" name=\"scope[]\" value=\"#{scope}\" />"
+          "<input type=\"hidden\" name=\"scope[]\" value=\"#{h(scope)}\" />"
         else
           <<-HTML
             <div class="form-check">
@@ -74,34 +74,16 @@
       end.join
     }
 
-    <input type="hidden" name="client_id" value="#{rodauth.param("client_id")}"/>
-    #{"<input type=\"hidden\" name=\"access_type\" value=\"#{rodauth.param("access_type")}\"/>" if rodauth.param_or_nil("access_type")}
-    #{"<input type=\"hidden\" name=\"response_type\" value=\"#{rodauth.param("response_type")}\"/>" if rodauth.param_or_nil("response_type")}
-    #{"<input type=\"hidden\" name=\"response_mode\" value=\"#{rodauth.param("response_mode")}\"/>" if rodauth.param_or_nil("response_mode")}
-    #{"<input type=\"hidden\" name=\"state\" value=\"#{rodauth.param("state")}\"/>" if rodauth.param_or_nil("state")}
-    #{"<input type=\"hidden\" name=\"redirect_uri\" value=\"#{rodauth.redirect_uri}\"/>" if rodauth.param_or_nil("redirect_uri")}
-    #{"<input type=\"hidden\" name=\"code_challenge\" value=\"#{rodauth.param("code_challenge")}\"/>" if rodauth.features.include?(:oauth_pkce) && rodauth.param_or_nil("code_challenge")}
-    #{"<input type=\"hidden\" name=\"code_challenge_method\" value=\"#{rodauth.param("code_challenge_method")}\"/>" if rodauth.features.include?(:oauth_pkce) && rodauth.param_or_nil("code_challenge_method")}
-    #{"<input type=\"hidden\" name=\"prompt\" value=\"#{rodauth.param("prompt")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("prompt")}
-    #{"<input type=\"hidden\" name=\"nonce\" value=\"#{rodauth.param("nonce")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("nonce")}
-    #{"<input type=\"hidden\" name=\"ui_locales\" value=\"#{rodauth.param("ui_locales")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("ui_locales")}
-    #{"<input type=\"hidden\" name=\"claims_locales\" value=\"#{rodauth.param("claims_locales")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("claims_locales")}
-    #{"<input type=\"hidden\" name=\"claims\" value=\"#{h(rodauth.param("claims"))}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("claims")}
-    #{"<input type=\"hidden\" name=\"acr_values\" value=\"#{rodauth.param("acr_values")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("acr_values")}
-    #{"<input type=\"hidden\" name=\"registration\" value=\"#{h(rodauth.param("registration"))}\"/>" if rodauth.features.include?(:oidc_self_issued) && rodauth.param_or_nil("registration")}
     #{
-      if rodauth.features.include?(:oauth_resource_indicators) && rodauth.resource_indicators
-        rodauth.resource_indicators.map do |resource|
-          "<input type=\"hidden\" name=\"resource\" value=\"#{resource}\"/>"
-        end.join
-      end
-      }
-    #{"<input type=\"hidden\" name=\"dpop_jkt\" value=\"#{h(rodauth.param("dpop_jkt"))}\"/>" if rodauth.features.include?(:oauth_dpop) && rodauth.param_or_nil("dpop_jkt")}
+      rodauth.authorize_form_params.map do |field|
+        "<input type=\"#{h(field["type"])}\" name=\"#{h(field["name"])}\" value=\"#{h(field["value"])}\"/>"
+      end.join
+    }
   </div>
   <p class="text-center">
     <input type="submit" class="btn btn-outline-primary" value="#{h(rodauth.oauth_authorize_button)}"/>
-    <a href="#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{ "&state=#{rodauth.param("state")}" if rodauth.param_or_nil("state")}" class="btn btn-outline-danger">
-      #{rodauth.oauth_cancel_button}
+    <a href="#{h(rodauth.redirect_uri)}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{ "&state=#{CGI.escape(rodauth.param("state"))}" if rodauth.param_or_nil("state")}" class="btn btn-outline-danger">
+      #{h(rodauth.oauth_cancel_button)}
     </a>
   </p>
 </form>

data/templates/device_verification.str

@@ -10,15 +10,15 @@
       scopes = @oauth_grant[rodauth.oauth_grants_scopes_column].split(rodauth.oauth_scope_separator)
       scopes.map do |scope|
         <<-HTML
-          <li class="list-group-item">#{scope}</li>
+          <li class="list-group-item">#{h(scope)}</li>
         HTML
       end.join
     }
     </ul>
   </div>
-  <input type="hidden" name="user_code" value="#{rodauth.param("user_code")}"/>
+  <input type="hidden" name="user_code" value="#{h(rodauth.param("user_code"))}"/>
   <p class="text-center">
     <input type="submit" class="btn btn-outline-primary" value="#{h(rodauth.oauth_device_verification_button)}"/>
-    <a href="#{rodauth.device_path}?error=access_denied" class="btn btn-outline-danger">#{rodauth.oauth_cancel_button}</a>
+    <a href="#{rodauth.device_path}?error=access_denied" class="btn btn-outline-danger">#{h(rodauth.oauth_cancel_button)}</a>
   </p>
 </form>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.5
+  version: 1.6.6
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -93,6 +93,7 @@ extra_rdoc_files:
 - doc/release_notes/1_6_3.md
 - doc/release_notes/1_6_4.md
 - doc/release_notes/1_6_5.md
+- doc/release_notes/1_6_6.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -144,6 +145,7 @@ files:
 - doc/release_notes/1_6_3.md
 - doc/release_notes/1_6_4.md
 - doc/release_notes/1_6_5.md
+- doc/release_notes/1_6_6.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -244,7 +246,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Implementation of the OAuth 2.0 protocol on top of rodauth.
 test_files: []