LoginSign Up
← Back to all sparks
M

mod_auth_openidc

INFRA · APIS
Velocity2.5

OpenID Connect and OAuth 2.0 authentication module for the Apache HTTP Server

github.com/OpenIDC/mod_auth_openidc ↗

mod_auth_openidc 2.4.20.4 closes a provider-to-host command execution path.

apache-moduleopenid-connectsecurity-hardeningsession-managementobservabilityauthentication
◆Current state
This Apache module implements OpenID Connect relying-party support, and its 2.4.20.x line has been a sustained security programme. 2.4.20.4 fixes a case where a provider could have a command run on the host via the exec: prefix in client metadata, sub-request session reuse that exposed protected content, a front-channel logout that could end another user's session, and quadratic memory use on large responses. It also adds interval-based access token refresh, cache metrics and a real readiness probe.
◆Where it's heading
Each 2.4.20.x release has taken one area through review: session crypto, the state-cookie parser, cache storage, and now metadata handling, sub-requests and logout. Observability is the second thread, with Prometheus self-health metrics and trace propagation added in this release.
◆Prediction
Further 2.4.20.x security releases are likely while the review continues. The sub-request change can trigger re-authentication where OIDCStripCookies or POST-body tokens are used, so operators should test before upgrading.

◆Recent moves

  1. 8d ago

    2.4.20.4: metadata command execution and logout flaws fixed

    The review reaches metadata, sub-requests, redirects and logout: a provider-controlled exec: prefix could run commands on the host, and front-channel logout could end another user's session. Refresh-interval, cache metrics and readiness-probe features ride along.

    View source ↗
  2. 2mo ago

    File and shared-memory caches hardened against flooding

    The hardening programme moves to storage: file-backed metadata and cache I/O refuse non-regular files, cap what a read may allocate and write metadata atomically, while the shm cache hashes keys with a per-segment keyed SipHash so an outsider can no longer flood one bucket chain. A session-kill bug that removed a newer logout index entry is fixed alongside. The 2.4.20.x session key incompatibility still applies, so upgrades from 2.4.19.x invalidate existing sessions.

    View source ↗
  3. 2mo ago

    Untagged GitHub artifact duplicating the 2.4.20.3 release

    A 55-character untagged GitHub release object carrying only a sign-off line, pointing at the same 2.4.20.3 work as the real release entry. It is a publishing artifact rather than a distinct release, and should be read as a duplicate of the tagged 2.4.20.3.

    View source ↗
  4. 3mo ago

    OIDCDebugMaskSecrets reopens debug logs, cache tier removed

    OIDCDebugMaskSecrets restores usable debug logging after the secret-masking work, and a cache tier is removed. It is the consolidation release between the audit fixes and the storage hardening that follows.

    View source ↗
  5. 3mo ago

    Internal audit finds eight issues, incl. an identity-header bypass

    ⚡ SPARK

    The internal audit that set the tone for the whole 2.4.20.x line, disclosing eight issues including an identity-header bypass. Everything shipped since reads as working through the classes of problem this audit surfaced.

    View source ↗
  6. 3mo ago

    PBKDF2 key stretching invalidates all existing sessions

    PBKDF2 key stretching changes how session encryption keys are derived, which is why every session created by 2.4.19.x and earlier is invalid after upgrade. It is the most operationally disruptive item in the line and is still restated in each subsequent release.

    View source ↗