Closed fMeow closed 7 months ago
Ahh.. Thought I tested this again before publishing. Thanks for spotting this and contributing the patch! Looks good. A configurable minimum time between retries is still on my list. If wrong keys are intentionally send, the axum server shouldn't try to perform a new discovery if a certain period of time didn't pass.
decoding_keys()
contains a read lock toKeycloakAuthInstance discovory.value
, which cause dead lock when executing OIDC discovery.This deadlock cause all services guarded by keyclock instance stuck forever. It can be easily reproduced with the example in docs, just by passing a token that triggers an OIDC discovery. We can try this token, which comes from a local dev keycloak server:
Cheers! We successfully perform a DoS attack with an invalid token that comes from an unknown server.
This PR limit the lifetime of decoding keys to the creation of raw_claims.
Here is the code at fault:
acquired read lock before discovering
acquiring value lock will dead lock when oidc discovering