andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(oidc): use authenticated encryption for opaque tokens (#12017)

Browse Source 
# Which Problems Are Solved

Opaque tokens now use authenticated encryption.

# How the Problems Are Solved

- Upgrade zitadel/oidc to v3.47
- Copy crypto implementation for refresh and session tokens (internal to
zitadel)
- Added config that allows validating old tokens for gradual roll-out

# Additional Changes

- Set NX cache for `integration-test-build` to `false`, working on a
seperate fix.

# Additional Context

- closes #11315

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: muhlemmer <[email protected]>
This commit is contained in:
Tim Möhlmann
2026-04-13 10:59:50 +00:00
committed by GitHub
co-authored by copilot-swe-agent[bot] <198982749+[email protected]> muhlemmer
parent a28ee63b02
commit 01fe34a526
46 changed files with 406 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proto/zitadel/oidc/v2/oidc_service.proto
+4 -4
View File
@@ -274,10 +274,10 @@ message Session {
// Token of the session used to login the user. This token verifies that the session is valid.
string session_token = 2 [
(validate.rules).string = {min_len: 1, max_len: 200},
(validate.rules).string = {min_len: 1, max_len: 500},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
min_length: 1;
max_length: 200;
max_length: 500;
},
(google.api.field_behavior) = REQUIRED
];
@@ -315,10 +315,10 @@ message GetDeviceAuthorizationRequestResponse {
message AuthorizeOrDenyDeviceAuthorizationRequest {
// The device authorization id returned when submitting the user code.
string device_authorization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(validate.rules).string = {min_len: 1, max_len: 500},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
min_length: 1;
max_length: 200;
max_length: 500;
},
(google.api.field_behavior) = REQUIRED
];
proto/zitadel/oidc/v2beta/oidc_service.proto
+2 -2
View File
@@ -210,10 +210,10 @@ message Session {
];
string session_token = 2 [
(validate.rules).string = {min_len: 1, max_len: 200},
(validate.rules).string = {min_len: 1, max_len: 500},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
min_length: 1;
max_length: 200;
max_length: 500;
description: "Token to verify the session is valid";
}
];
proto/zitadel/saml/v2/saml_service.proto
+2 -2
View File
@@ -213,11 +213,11 @@ message Session {
// Token to verify the session is valid.
string session_token = 2 [
(validate.rules).string = {min_len: 1, max_len: 200},
(validate.rules).string = {min_len: 1, max_len: 500},
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
min_length: 1;
max_length: 200;
max_length: 500;
}
];
}
proto/zitadel/session/v2/session_service.proto
+2 -2
View File
@@ -327,10 +327,10 @@ message GetSessionRequest{
// - the security token provided in the authorization header has the same user agent as the session
// - the caller is granted the permission session.read permission on either the instance or on the checked user's organization
optional string session_token = 2 [
(validate.rules).string = {min_len: 1, max_len: 200},
(validate.rules).string = {min_len: 1, max_len: 500},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
min_length: 1;
max_length: 200;
max_length: 500;
example: "\"222430354126975533\"";
}
];
proto/zitadel/session/v2beta/session_service.proto
+3 -3
View File
@@ -329,10 +329,10 @@ message SetSessionRequest{
}
];
string session_token = 2 [
(validate.rules).string = {min_len: 0, max_len: 200},
(validate.rules).string = {min_len: 0, max_len: 500},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
min_length: 1;
max_length: 200;
min_length: 0;
max_length: 500;
description: "\"DEPRECATED: this field is ignored.\"";
}
];