mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

🔴 [P0] Implement OIDC token validation (authentication bypass) #271

New Issue
Closed
opened 2026-02-03 22:29:13 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-03 22:29:13 +00:00
Owner
Copy Link

Summary

OIDC token validation is a placeholder that always returns valid: false. Federated authentication is completely non-functional.

Location

apps/api/src/federation/oidc.service.ts:114-138

Security Impact

  • Complete authentication bypass for federated users
  • Any attacker can impersonate any user on federated instances
  • Identity linking (#87) and OIDC integration (#86) are non-functional

Required Implementation

  1. Use jose or jsonwebtoken library for JWT validation
  2. Fetch OIDC discovery metadata from remote instances
  3. Retrieve and cache JWKS (JSON Web Key Set)
  4. Verify JWT signature using public key from JWKS
  5. Validate all claims (iss, aud, exp, nbf, iat)
  6. Handle token refresh mechanism

Acceptance Criteria

  • JWT signature verification works
  • All standard claims validated
  • JWKS fetching and caching implemented
  • Token validation integration tests pass
  • Identity linking works with valid OIDC tokens
  • Invalid tokens properly rejected

Priority

CRITICAL (P0) - Blocks production deployment

## Summary OIDC token validation is a placeholder that always returns `valid: false`. Federated authentication is completely non-functional. ## Location `apps/api/src/federation/oidc.service.ts:114-138` ## Security Impact - Complete authentication bypass for federated users - Any attacker can impersonate any user on federated instances - Identity linking (#87) and OIDC integration (#86) are non-functional ## Required Implementation 1. Use `jose` or `jsonwebtoken` library for JWT validation 2. Fetch OIDC discovery metadata from remote instances 3. Retrieve and cache JWKS (JSON Web Key Set) 4. Verify JWT signature using public key from JWKS 5. Validate all claims (iss, aud, exp, nbf, iat) 6. Handle token refresh mechanism ## Acceptance Criteria - [ ] JWT signature verification works - [ ] All standard claims validated - [ ] JWKS fetching and caching implemented - [ ] Token validation integration tests pass - [ ] Identity linking works with valid OIDC tokens - [ ] Invalid tokens properly rejected ## Priority **CRITICAL (P0)** - Blocks production deployment
jason.woltje added the securityp0apiapi labels 2026-02-03 22:29:13 +00:00
jason.woltje added this to the M7.1-Remediation (0.0.8) milestone 2026-02-03 22:31:44 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api p0 security
Milestone
No items
No Milestone M7.1-Remediation (0.0.8)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#271
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?