06ff2f8ed4
Opus Cross-cutting audit found a classic OIDC account-takeover hole in
kei-auth-google::verify(). Same class as the public Booking.com / Slack /
GitLab pattern.
Root cause: verify() accepted info.email from userinfo response as user_id
WITHOUT checking info.email_verified. A Google Workspace admin can mint
accounts with arbitrary unverified email aliases. Attacker then OAuth-flows
into the relying party using a victim's email as their alias and gets a
session bound to that user_id. No email verification = no auth.
Fix in 3 layers (defense in depth):
1. email_verified GATE
- client.rs: UserInfo gains email_verified: bool with #[serde(default)] —
absent field defaults to false (fail-closed).
- error.rs: new Error::EmailNotVerified variant.
- provider.rs::verify(): rejects with EmailNotVerified before any session
is built when email_verified != true.
2. sub AS PRIMARY user_id
- provider.rs::verify(): user_id = info.sub (Google's stable account id),
NOT info.email. Email is now mutable metadata only. Email reassignment
in Google Workspace cannot redirect an existing user_id binding.
3. id_token.sub CROSS-CHECK
- id_token.rs (new, 104 LOC): JWT-claims-only extract_sub() — parses
base64-payload without signature verification (signature verification
against Google JWKS is a documented follow-up atomar).
- provider.rs::verify(): when TokenResponse.id_token is present, decode
claims and require id_token.sub == userinfo.sub. New
Error::IdSubMismatch + IdTokenMalformed variants.
- This adds defense against a forged userinfo response even though
signature is not yet verified.
Constructor Pattern compliance: provider.rs split into provider.rs (181 LOC)
+ verify_helpers.rs (114 LOC, with unpack_challenge / check_state /
enforce_email_verified / cross_check_id_token_sub helpers). All files <200
LOC, all functions <30 LOC.
Tests added: tests/google_security_regression.rs (164 LOC, 5 dedicated
CVE-2023-7028 regression tests). All 26 tests pass:
- verify_rejects_unverified_email
- verify_rejects_missing_email_verified_field
- verify_uses_sub_not_email_as_user_id
- verify_rejects_id_token_sub_mismatch
- verify_accepts_matching_id_token_sub
cargo check --workspace clean. cargo test -p kei-auth-google: 26/26 pass.
Follow-up: JWT signature verification against Google's JWKS endpoint with
kid-based key cache + RS256/ES256 — separate atomar (~150 LOC).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
108 lines
3.5 KiB
Rust
108 lines
3.5 KiB
Rust
// SPDX-License-Identifier: Apache-2.0
|
|
// Copyright 2026 <author org>
|
|
//!
|
|
//! Wiremock smoke tests for `GoogleAuthClient` HTTP layer. No live HTTP.
|
|
|
|
use kei_auth_google::GoogleAuthClient;
|
|
use serde_json::json;
|
|
use wiremock::matchers::{body_string_contains, header, method, path};
|
|
use wiremock::{Mock, MockServer, ResponseTemplate};
|
|
|
|
fn client_for(server: &MockServer) -> GoogleAuthClient {
|
|
GoogleAuthClient::with_urls(
|
|
format!("{}/token", server.uri()),
|
|
format!("{}/userinfo", server.uri()),
|
|
"client-id-xyz",
|
|
"client-secret-xyz",
|
|
"https://example.com/cb",
|
|
)
|
|
.unwrap()
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn token_endpoint_200_returns_access_token() {
|
|
let server = MockServer::start().await;
|
|
Mock::given(method("POST"))
|
|
.and(path("/token"))
|
|
.and(body_string_contains("grant_type=authorization_code"))
|
|
.and(body_string_contains("code=abc123"))
|
|
.and(body_string_contains("client_id=client-id-xyz"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"access_token": "ya29.a0AfH-test",
|
|
"expires_in": 3600,
|
|
"id_token": "eyJ.fake.jwt"
|
|
})))
|
|
.expect(1)
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let client = client_for(&server);
|
|
let token = client.exchange_code("abc123", None).await.unwrap();
|
|
assert_eq!(token.access_token, "ya29.a0AfH-test");
|
|
assert_eq!(token.expires_in, 3600);
|
|
assert_eq!(token.id_token.as_deref(), Some("eyJ.fake.jwt"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn userinfo_200_returns_email_and_sub() {
|
|
let server = MockServer::start().await;
|
|
Mock::given(method("GET"))
|
|
.and(path("/userinfo"))
|
|
.and(header("authorization", "Bearer ya29.a0AfH-test"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"sub": "1234567890",
|
|
"email": "alice@example.com",
|
|
"email_verified": true,
|
|
"name": "Alice"
|
|
})))
|
|
.expect(1)
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let client = client_for(&server);
|
|
let info = client.userinfo("ya29.a0AfH-test").await.unwrap();
|
|
assert_eq!(info.sub, "1234567890");
|
|
assert_eq!(info.email, "alice@example.com");
|
|
assert!(info.email_verified);
|
|
assert_eq!(info.name, "Alice");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn userinfo_omits_email_verified_defaults_to_false() {
|
|
let server = MockServer::start().await;
|
|
Mock::given(method("GET"))
|
|
.and(path("/userinfo"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"sub": "abc",
|
|
"email": "x@y.z",
|
|
"name": "X"
|
|
})))
|
|
.expect(1)
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let client = client_for(&server);
|
|
let info = client.userinfo("any").await.unwrap();
|
|
// serde_default safe interpretation: absent ⇒ false ⇒ provider rejects.
|
|
assert!(!info.email_verified);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn exchange_code_400_returns_api_error() {
|
|
let server = MockServer::start().await;
|
|
Mock::given(method("POST"))
|
|
.and(path("/token"))
|
|
.respond_with(ResponseTemplate::new(400).set_body_json(json!({
|
|
"error": "invalid_grant",
|
|
"error_description": "Bad code"
|
|
})))
|
|
.expect(1)
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let client = client_for(&server);
|
|
let err = client.exchange_code("bad-code", None).await.unwrap_err();
|
|
let msg = format!("{err}");
|
|
assert!(msg.contains("api"), "expected api variant, got {msg}");
|
|
assert!(msg.contains("400"), "expected status 400 in message, got {msg}");
|
|
}
|