AshAuthentication.Oauth2Server.CIMD.ReqFetcher (ash_authentication_oauth2_server v0.3.0)

Copy Markdown View Source

The default Client ID Metadata Document fetcher, built on Req.

A CIMD client_id is an attacker-suppliable URL that this server fetches — the textbook SSRF setup — so every request goes through an outbound policy before any bytes leave the box:

  • URL shape — https scheme, a real host, a non-root path component (per the CIMD draft), no fragment, no userinfo, and port 443 unless :allowed_ports says otherwise.
  • Address validation — the host is resolved up front and every returned address must be publicly routable. Loopback, RFC 1918, link-local (including the cloud metadata range 169.254.0.0/16), CGNAT, multicast, reserved ranges, and their IPv6 equivalents (including v4-mapped/NAT64/6to4 forms, whose embedded IPv4 is re-checked) are all rejected.
  • Pinned connect — the request connects to the validated IP while keeping TLS verification, SNI, and the Host header on the original hostname (Mint's :hostname option). This closes the DNS-rebinding window between "resolve and check" and "connect".
  • No redirects — a redirect response is an error. A compliant CIMD document is served directly at its client_id URL.
  • Bounded response — the body is capped at :max_body_bytes (default 64 KiB) and the request at :receive_timeout / :connect_timeout (default 5s each).

Requires the optional :req dependency:

{:req, "~> 0.5"}

Options (via :cimd_fetch_options on your server module)

  • :max_body_bytes — response size cap (default 65_536)
  • :connect_timeout — TCP/TLS connect timeout in ms (default 5_000)
  • :receive_timeout — response receive timeout in ms (default 5_000)
  • :allowed_ports — permitted URL ports (default [443])
  • :allow_non_public_ips? — skip the address validation entirely (default false). Never enable this in production — it exists for development against local stub servers only.