LoginSign Up
← Back to all sparks
M

mod_auth_openidc

INFRA · APIS
Velocity6.3

OpenID Connect and OAuth 2.0 authentication module for the Apache HTTP Server

github.com/OpenIDC/mod_auth_openidc ↗

mod_auth_openidc audited itself, found eight holes, and broke every session on the way out

oidcapachesecurity-auditsession-encryptionauth-bypassbreaking-change
◆Current state
The Apache OIDC module is in the middle of the most consequential ten days in this window: 2.4.20 on August 1 rebuilt session and cookie encryption around PBKDF2-HMAC-SHA256 key stretching and invalidated every existing session, 2.4.20.1 on August 9 disclosed eight security issues found in an internal audit, and 2.4.20.2 the next morning walked back part of the fallout. The audit findings are not peripheral — the most serious lets a client inject headers that a protected backend trusts as authenticated identity claims on paths the module answers without authenticating. The 2.4.19.x line before it had already shipped an out-of-bounds read and write in the state-cookie parser.
◆Where it's heading
The project has shifted from feature work to hardening its own attack surface, and it is doing so on its own initiative rather than in response to external reports. That posture has a cost operators are absorbing directly: two backwards-incompatible session format changes in six months, both of which log every user out on upgrade. The 2.4.20.2 release also shows the hardening overshooting and being corrected — unconditional secret masking made debugging impossible, so an opt-in escape hatch was added with a startup warning attached, and a derived-object cache tier added only weeks earlier was removed outright.
◆Prediction
Expect the 2.4.20.x line to keep absorbing follow-up fixes from the same audit, and any further hardening to arrive with an explicit opt-out after the masking reversal showed operators cannot troubleshoot a protocol exchange they cannot read.

◆Recent moves

  1. 1d ago

    OIDCDebugMaskSecrets reopens debug logs, cache tier removed

    A same-week correction to the previous two releases: the unconditional secret masking 2.4.20.1 introduced gets an opt-out so a protocol exchange can be read during troubleshooting, defaulting to on and warning at every startup while disabled. The derived-object cache tier that 2.4.20 added and 2.4.20.1 reworked is removed entirely — a feature introduced and withdrawn inside ten days.

    View source ↗
  2. 1d ago

    Internal audit turns up eight security issues, including an identity-header bypass

    ⚡ SPARK

    The pivot point of this whole window: an internal audit produced eight fixes at once, and the surrounding releases are its setup and its cleanup. It confirms the hardening push that 2.4.20's crypto rework started was a deliberate program rather than a one-off.

    View source ↗
  3. 10d ago

    PBKDF2 key stretching invalidates all existing sessions

    The crypto rework that opened the hardening push: OIDCCryptoPassphrase is now stretched into the AES key with PBKDF2-HMAC-SHA256 at 210,000 iterations rather than used more directly, and the internal session format changes incompatibly so every existing session and cookie is invalid. OAuth resource-server mode also gains explicit audience and issuer binding for locally validated JWTs.

    View source ↗
  4. 1mo ago

    Out-of-bounds read and write fixed in the state-cookie parser

    A memory-safety fix in the state-cookie parser with its own advisory, plus a flag-handling bug that silently dropped the RESTRICTED constraint on Apache expressions in directives valid inside .htaccess. Both are the same class of finding the August audit went on to produce in bulk.

    View source ↗
  5. 2mo ago

    Fixes core dumps under threaded MPM startup load

    Stability work on the 2.4.19 line: intermittent core dumps on bursts of parallel requests after startup in threaded MPM setups, a metadata JWKS memory leak, and a spec-compliance fix adding scope=openid when a request object is passed by reference. Routine maintenance in the months before the security push.

    View source ↗
  6. 5mo ago

    Fixes claims-based authorization regression in OAuth RS mode

    A single-fix patch closing a claims-based authorization regression introduced in 2.4.19, with the rest of the entry given over to commercial support and licensed-binary notices. Typical of the point releases that follow each of this project's incompatible session-format changes.

    View source ↗