fix(security): reject colon in token subject to prevent Basic Auth encoding issues

commit: 37ca27ddcdf3a899372946dab8663880ba9a4ffc
author: brice · 7mo ago · 2026-03-23 05:34 UTC
parent: 925cad7
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +5 -0

M internal/usecase/auth/service.go +5 -0


@@ -5,6 +5,7 @@ import (
5	5		"context"
6	6		"errors"
7	7		"fmt"
	8	+	"strings"
8	9		"time"
9	10
10	11		"github.com/bnema/zerowrap"

@@ -263,6 +264,10 @@ func (s Service) isEphemeralAccessToken(claims domain.TokenClaims) bool {
263	264
264	265		// GenerateToken creates a new JWT token for the given subject.
265	266		func (s *Service) GenerateToken(ctx context.Context, subject string, scopes []string, expiry time.Duration) (string, error) {
	267	+	if strings.Contains(subject, ":") {
	268	+	return "", fmt.Errorf("subject %q must not contain ':' (used as Basic Auth username)", subject)
	269	+	}
	270	+
266	271		ctx = zerowrap.CtxWithFields(ctx, map[string]any{
267	272		zerowrap.FieldLayer: "usecase",
268	273		zerowrap.FieldUseCase: "GenerateToken",


@@ -5,6 +5,7 @@ import (
5	"context"	5		"context"
6	"errors"	6		"errors"
7	"fmt"	7		"fmt"
		8	+	"strings"
8	"time"	9		"time"
9		10
10	"github.com/bnema/zerowrap"	11		"github.com/bnema/zerowrap"

@@ -263,6 +264,10 @@ func (s Service) isEphemeralAccessToken(claims domain.TokenClaims) bool {
263		264
264	// GenerateToken creates a new JWT token for the given subject.	265		// GenerateToken creates a new JWT token for the given subject.
265	func (s *Service) GenerateToken(ctx context.Context, subject string, scopes []string, expiry time.Duration) (string, error) {	266		func (s *Service) GenerateToken(ctx context.Context, subject string, scopes []string, expiry time.Duration) (string, error) {
		267	+	if strings.Contains(subject, ":") {
		268	+	return "", fmt.Errorf("subject %q must not contain ':' (used as Basic Auth username)", subject)
		269	+	}
		270	+
266	ctx = zerowrap.CtxWithFields(ctx, map[string]any{	271		ctx = zerowrap.CtxWithFields(ctx, map[string]any{
267	zerowrap.FieldLayer: "usecase",	272		zerowrap.FieldLayer: "usecase",
268	zerowrap.FieldUseCase: "GenerateToken",	273		zerowrap.FieldUseCase: "GenerateToken",