kennethreitz 6759c67c77 Harden JWTAuth/OAuth2Auth: close 9 security and correctness findings ...

A dedicated adversarial pass over the 8.1.0 auth code found nine issues,
all in responder/ext/auth.py, each now fixed with a regression test:

Security: reject plaintext http JWKS URLs (MITM key injection); cap
unknown-kid JWKS refetches behind a cache + cooldown (unauthenticated DoS);
require exp by default (require_exp=True); stop mutating/freezing OAuth2
introspection principals (privilege retention).

Correctness: a JWKS scheme sent an HS256 token no longer 500s (now 401);
audience=None actually disables aud verification (was rejecting every OIDC
token); scope and scp claims are unioned (Azure/Auth0 scp tokens no longer
403); empty OAuth2 flow URLs raise instead of emitting an invalid spec.

Every fix verified fail-before/pass-after, then re-checked by an independent
adversarial pass. Full suite green on 3.11 and 3.14.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-03 13:14:05 -04:00

..

__init__.py

added test cases for routes.py

2018-10-13 13:59:46 +01:00

conftest.py

v5 B3: secure-by-default sessions

2026-06-28 10:37:14 -04:00

test_annotated_markers.py

Drop Python 3.10 support for v7

2026-06-29 14:31:46 -04:00

test_async_backends.py

v5 B4: async-native backends + sliding-TTL touch

2026-06-28 10:41:43 -04:00

test_auth_jwt.py

Harden JWTAuth/OAuth2Auth: close 9 security and correctness findings

2026-07-03 13:14:05 -04:00

test_auth.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_background_async.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_cli.py

Rename ResponderServer._stop so it no longer shadows Thread._stop

2026-07-02 21:54:04 -04:00

test_clientgen_pathparam_escaping.py

Escape path-param names in generated client string literals (#618)

2026-07-01 13:50:28 -04:00

test_clientgen.py

Fix 27 correctness bugs across routing, responses, OpenAPI/clientgen, and utilities; add v8 migration guide

2026-07-02 21:30:28 -04:00

test_composable_di.py

Release v7.0.5

2026-06-30 12:02:24 -04:00

test_concurrency_hardening.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_content_type_case.py

Match Content-Type case-insensitively per RFC 7231 (#612)

2026-07-01 12:52:22 -04:00

test_contract_app.py

Add Atelier contract example

2026-06-30 12:47:48 -04:00

test_cookies_vary.py

v6.0: remove 5.x deprecation shims + flip defaults to correct behavior

2026-06-28 20:57:39 -04:00

test_correctness_fixes.py

Fix multipart field parsing, non-UTF-8 request-id crash, and descending-sort None order

2026-07-01 15:11:24 -04:00

test_coverage.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_dependencies.py

Document and test 7.0 route dispatch ordering

2026-06-29 13:29:33 -04:00

test_dependency_overrides.py

v5.4: dependency_overrides, health checks, file conditionals, named routes

2026-06-28 20:30:34 -04:00

test_deprecations_810.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_deprecations_v6.py

v6.0: remove 5.x deprecation shims + flip defaults to correct behavior

2026-06-28 20:57:39 -04:00

test_devex_810.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_di_nesting.py

Support nested inline Depends; cache dependency & body-param inspection

2026-07-01 15:22:35 -04:00

test_dispatch_fixes_80.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_download_filename.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_encodings.py

v3.0.0: Modernize for latest Starlette, drop EOL Pythons

2026-03-22 05:51:47 -04:00

test_examples.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_ext_810.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_file_conditional.py

v6.4.0: typed path parameters, sharper path-param OpenAPI, If-Range

2026-06-29 02:08:50 -04:00

test_fortunes_example.py

Add fortunes example app

2026-06-30 13:21:14 -04:00

test_generic_response_model.py

v5.3: Annotated markers, generic response_model, OpenAPI authoring

2026-06-28 20:17:38 -04:00

test_graphql_async_resolvers.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_graphql_get_csrf.py

Reject GraphQL mutations over HTTP GET (CSRF guard) (#617)

2026-07-01 13:46:56 -04:00

test_graphql.py

v5 B5: uppercase req.method with case-insensitive deprecation shim

2026-06-28 10:27:00 -04:00

test_health.py

v5.4: dependency_overrides, health checks, file conditionals, named routes

2026-06-28 20:30:34 -04:00

test_hsts.py

v5.1: finish v5's typed/OpenAPI story + add expected ergonomics

2026-06-28 19:48:22 -04:00

test_http_semantics.py

Bump version to 7.0.4 and update changelog

2026-06-30 01:59:53 -04:00

test_improvements.py

Unify websocket route dispatch ordering with hook-auth-dependency pipeline

2026-06-29 13:41:24 -04:00

test_load_target.py

Move pueblo and graphene behind 'cli' and 'graphql' extras

2026-06-12 01:29:59 -04:00

test_logging.py

Fix client IP resolution for rate limiting and access logging behind proxies

2026-06-30 16:30:31 -04:00

test_marker_constraints.py

v5.1: finish v5's typed/OpenAPI story + add expected ergonomics

2026-06-28 19:48:22 -04:00

test_method_case.py

Remove private dependency resolver shim for v7

2026-06-29 14:41:23 -04:00

test_middleware_decorator.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_middleware_stack.py

v5 B3: secure-by-default sessions

2026-06-28 10:37:14 -04:00

test_models_801.py

Fix 27 correctness bugs across routing, responses, OpenAPI/clientgen, and utilities; add v8 migration guide

2026-07-02 21:30:28 -04:00

test_models_810.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_models.py

Bump version to 7.0.4 and update changelog

2026-06-30 01:59:53 -04:00

test_mount_lifespan_fixes.py

Fix WSGI/ASGI mount detection and lifespan app; offload large auto-etag hash

2026-07-01 15:27:20 -04:00

test_named_routes.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_negotiation_fixes.py

Improve content negotiation: Accept ranges/q-values, msgpack detect, request charset

2026-07-01 15:18:36 -04:00

test_net.py

Fix client IP resolution for rate limiting and access logging behind proxies

2026-06-30 16:30:31 -04:00

test_new_features.py

Fix client IP resolution for rate limiting and access logging behind proxies

2026-06-30 16:30:31 -04:00

test_openapi_801.py

Fix 27 correctness bugs across routing, responses, OpenAPI/clientgen, and utilities; add v8 migration guide

2026-07-02 21:30:28 -04:00

test_openapi_810.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_openapi_authoring.py

Release v7.1.0

2026-06-30 12:29:49 -04:00

test_openapi_validation.py

Release v7.0.5

2026-06-30 12:02:24 -04:00

test_pagination.py

v6.2.0: pagination helpers (Page[T] envelope + paginate)

2026-06-29 01:34:30 -04:00

test_plumbing_801.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_problem_exception.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_query_helpers.py

v6.3.0: sorting & filtering helpers (responder.ext.query)

2026-06-29 01:43:03 -04:00

test_redirect_default.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_redis_backends.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_request_cookies.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_responder.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_response_headers_ci.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_response_helpers.py

Release v7.1.0

2026-06-30 12:29:49 -04:00

test_round3.py

Make problem details the default error format

2026-06-29 13:12:45 -04:00

test_round4.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_round5.py

Remove request_model and add scoped auth for v7

2026-06-29 14:40:34 -04:00

test_round6.py

Bump version to 7.0.4 and update changelog

2026-06-30 01:59:53 -04:00

test_round7.py

v6.3.1: emit OpenAPI parameters at the operation level (fix cross-method leak)

2026-06-29 01:54:24 -04:00

test_router_include.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_routes_801.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_routes_810.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_secure_sessions.py

v5 B3: secure-by-default sessions

2026-06-28 10:37:14 -04:00

test_security_headers.py

v5.2: auth ext + OpenAPI security schemes + security-headers middleware

2026-06-28 20:02:35 -04:00

test_server_selection.py

Add Granian server selection for api.run

2026-06-29 13:55:40 -04:00

test_sessions_memory_bounds.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_sse_injection.py

Prevent SSE frame injection via newlines in event/id/retry/comment (#616)

2026-07-01 13:21:20 -04:00

test_sse.py

v6.1.0: production-grade Server-Sent Events

2026-06-29 01:22:40 -04:00

test_static_dir_80.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_status_codes.py

Stabilize 413 problem title across Python versions

2026-06-29 14:54:19 -04:00

test_sync_handlers_offloop.py

Run sync lifecycle and exception handlers off the event loop (#611)

2026-07-01 12:50:53 -04:00

test_templates_context.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_text_charset.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

test_todo_example.py

Add todo example app

2026-06-30 13:04:51 -04:00

test_typed_io.py

v6.4.0: typed path parameters, sharper path-param OpenAPI, If-Range

2026-06-29 02:08:50 -04:00

test_typed_openapi.py

Remove request_model and add scoped auth for v7

2026-06-29 14:40:34 -04:00

test_uploads.py

v5.5: type-driven file uploads & form fields (File/Form markers)

2026-06-28 20:40:32 -04:00

test_v5_review_fixes.py

Remove request_model and add scoped auth for v7

2026-06-29 14:40:34 -04:00

test_v7_error_contract.py

Release v7.0.5

2026-06-30 12:02:24 -04:00

test_v602_interactions.py

Remove request_model and add scoped auth for v7

2026-06-29 14:40:34 -04:00

test_v660_features.py

DRY up framework error response handling

2026-06-29 14:30:03 -04:00

test_v713_improvements.py

Add JWT/OAuth2 auth, Problem exception, function middleware, and a broad feature sweep for 8.1.0

2026-07-03 07:08:42 -04:00

test_vast_improvements.py

Update abort test for problem details default

2026-06-29 13:22:30 -04:00

test_verb_decorators.py

v5.1: finish v5's typed/OpenAPI story + add expected ergonomics

2026-06-28 19:48:22 -04:00

test_ws_idle_timeout.py

Add WebSocket idle timeout (API ws_idle_timeout) (#614)

2026-07-01 13:03:19 -04:00

test_yaml_mediatype.py

Add standalone Router composition; fix lifespan/dispatch/header correctness; 8.0 behavior changes

2026-07-01 17:05:08 -04:00

util.py

Code quality improvements and test fixes (#592)

2026-03-22 07:44:11 -04:00