security: comprehensive hardening from security audit (43 findings)
Fixes 5 HIGH, 16 MEDIUM, 14 LOW, 8 INFO findings across 7 phases:
- Token revocation blacklist via jti claims in SQLite (H-2)
- Session endpoint auth hardening with gateway token validation (H-1)
- Refresh token scope validation per RFC 6749 Section 6 (M-9)
- Removed plain PKCE from OIDC discovery, S256-only (H-3)
- Passkey challenges moved from in-memory to SQLite (M-4)
- TOTP replay protection via absolute period tracking (M-5)
- Email verification lockout after 5 failed attempts (M-8)
- OAuth PDS sessions moved from in-memory to SQLite (L-1)
- AES-256-GCM IV migration (16->12 bytes) with HKDF key derivation (L-3/L-4)
- JWT kid fallback hardened - reject when kid present but not found (L-2)
- WebAuthn requireUserVerification enforced (M-2)
- Webhook HTML escaping for XSS prevention (M-7)
- CSP form-action directive added (M-6)
- Recovery scope restricted to openid/profile/email (L-7)
- Cache-Control: no-store on token info endpoint (M-1)
- Docker image SHA pinning, compose security hardening (D-2/D-3)
- CI kubeconfig cleanup with mktemp+trap (D-1)
- Rust lib: zeroize secrets on drop, RwLock poison recovery,
removed unused postgres deps, pinned chrono, upgraded rusqlite
- OIDC presets: pkce_note documentation for disabled PKCE clients
423 tests passing, 0 npm vulnerabilities.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
security: comprehensive hardening from security audit (43 findings)
Fixes 5 HIGH, 16 MEDIUM, 14 LOW, 8 INFO findings across 7 phases:
- Token revocation blacklist via jti claims in SQLite (H-2)
- Session endpoint auth hardening with gateway token validation (H-1)
- Refresh token scope validation per RFC 6749 Section 6 (M-9)
- Removed plain PKCE from OIDC discovery, S256-only (H-3)
- Passkey challenges moved from in-memory to SQLite (M-4)
- TOTP replay protection via absolute period tracking (M-5)
- Email verification lockout after 5 failed attempts (M-8)
- OAuth PDS sessions moved from in-memory to SQLite (L-1)
- AES-256-GCM IV migration (16->12 bytes) with HKDF key derivation (L-3/L-4)
- JWT kid fallback hardened - reject when kid present but not found (L-2)
- WebAuthn requireUserVerification enforced (M-2)
- Webhook HTML escaping for XSS prevention (M-7)
- CSP form-action directive added (M-6)
- Recovery scope restricted to openid/profile/email (L-7)
- Cache-Control: no-store on token info endpoint (M-1)
- Docker image SHA pinning, compose security hardening (D-2/D-3)
- CI kubeconfig cleanup with mktemp+trap (D-1)
- Rust lib: zeroize secrets on drop, RwLock poison recovery,
removed unused postgres deps, pinned chrono, upgraded rusqlite
- OIDC presets: pkce_note documentation for disabled PKCE clients
423 tests passing, 0 npm vulnerabilities.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>