LoginSign Up
← Back to all sparks
M

mod_auth_openidc

INFRA · APIS
Velocity6.3

OpenID Connect and OAuth 2.0 authentication module for the Apache HTTP Server

github.com/OpenIDC/mod_auth_openidc ↗

mod_auth_openidc keeps hardening its own attack surface, one audited subsystem at a time

apache-moduleopenid-connectsecurity-hardeningsession-managementcachingauthentication
◆Current state
This is the Apache module implementing OpenID Connect relying-party support, and its 2.4.20.x line has been an almost unbroken security programme. An internal audit turned up eight issues including an identity-header bypass; PBKDF2 key stretching changed the session encryption key and invalidated every session created by 2.4.19.x and earlier; out-of-bounds reads and writes were fixed in the state-cookie parser. The latest release continues in the same register, hardening file-backed metadata and cache I/O and the shared-memory cache itself.
◆Where it's heading
The project is working outward from the code paths an attacker actually reaches: cookie parsing, then session key derivation, then cache storage and the files the module reads at runtime. Keyed hashing of cache keys to stop bucket-chain flooding, refusing non-regular files, capping allocations and writing metadata atomically all address resource-exhaustion and file-substitution classes rather than single bugs. Packaging and commercial distribution notes take up an increasing share of each release body, with Redis and Valkey over TLS behind a commercial agreement.
◆Prediction
With the cache and file layers now hardened, the remaining large surface is the HTTP client and provider metadata handling, so that is the likeliest next area — and the 2.4.20.x line should settle into ordinary maintenance once the audit backlog is worked through.

◆Recent moves

  1. 15d ago

    File and shared-memory cache hardened against flooding and substitution

    The hardening programme moves to storage: file-backed metadata and cache I/O refuse non-regular files, cap what a read may allocate and write metadata atomically, while the shm cache hashes keys with a per-segment keyed SipHash so an outsider can no longer flood one bucket chain. A session-kill bug that removed a newer logout index entry is fixed alongside. The 2.4.20.x session key incompatibility still applies, so upgrades from 2.4.19.x invalidate existing sessions.

    View source ↗
  2. 15d ago

    Untagged GitHub artifact duplicating the 2.4.20.3 release

    A 55-character untagged GitHub release object carrying only a sign-off line, pointing at the same 2.4.20.3 work as the real release entry. It is a publishing artifact rather than a distinct release, and should be read as a duplicate of the tagged 2.4.20.3.

    View source ↗
  3. 1mo ago

    OIDCDebugMaskSecrets reopens debug logs, cache tier removed

    OIDCDebugMaskSecrets restores usable debug logging after the secret-masking work, and a cache tier is removed. It is the consolidation release between the audit fixes and the storage hardening that follows.

    View source ↗
  4. 1mo ago

    Internal audit turns up eight security issues, including an identity-header bypass

    ⚡ SPARK

    The internal audit that set the tone for the whole 2.4.20.x line, disclosing eight issues including an identity-header bypass. Everything shipped since reads as working through the classes of problem this audit surfaced.

    View source ↗
  5. 1mo ago

    PBKDF2 key stretching invalidates all existing sessions

    PBKDF2 key stretching changes how session encryption keys are derived, which is why every session created by 2.4.19.x and earlier is invalid after upgrade. It is the most operationally disruptive item in the line and is still restated in each subsequent release.

    View source ↗
  6. 2mo ago

    Out-of-bounds read and write fixed in the state-cookie parser

    Out-of-bounds read and write fixed in the state-cookie parser — an unauthenticated-input path, and an early entry in the same programme that later hardened the cache and file layers.

    View source ↗