OAuth hardening, passkey policy and auth events

​

OAuth login hardening

• Browser-bound state. /start sets an HttpOnly theauth_oauth_state cookie holding a secret that is separate from the state query parameter. The server stores only its SHA-256 next to the flow record and compares it in constant time at /callback. A login CSRF (attacker’s state plus code delivered to a victim’s browser) fails. The state is single use and is burned even when the binding check fails.
• PKCE S256 on every authorization-code flow.
• OIDC nonce for providers implementing theauth.NonceProvider (provider/oidc does). The nonce is checked against the verified ID token.
• Verified email to link. A sign-in whose provider email matches an existing account is refused unless the provider marks the email verified. Provider emails are lower-cased and trimmed before lookup.

​

Generic OIDC provider

p, err := oidc.New(ctx, oidc.Config{
    Name: "corp", Issuer: "https://idp.example.com",
    ClientID: "...", ClientSecret: "...",
})
cfg.Providers = append(cfg.Providers, p)

​

Passkey policy

• RequireUserVerification: registration and login demand UV, so a passkey is never a bare possession factor. Default false.
• CloneWarning: CloneWarningReject (default, refuses the login) or CloneWarningFlag (allows it and emits passkey.clone_warning).

​

Auth event stream

cfg.AuthEventSink = func(ctx context.Context, e theauth.AuthEvent) {
    siem.Send(e.Type, e.UserID, e.IPPrefix, e.Method, e.Reason)
}
// or: theauth.AuthEventChannelSink(ch)  // non-blocking, drops when full