OpenIDC/mod_auth_openidc v2.4.20.4 on GitHub

The 2.4.20.x versions use a backwards incompatible session encryption key so existing sessions (created by versions <=2.4.19.x) are invalid.

Security

config: the exec: prefix of OIDCClientSecret and OIDCClientTokenEndpointKeyPassword is honored only in the configuration directive; since 2.4.16 it was also applied to the same values when read from metadata (a Dynamic Client Registration response, .client/.conf files), so a provider could have a command executed on the host (GHSA-j3g4-73w8-p842, reported by @ivantsepp)
OAuth 2.0 RS (deprecated): cached access token validation results are bound to the verifier that produced them (introspection endpoint and client ID, or JWKs URI and verification keys); vhosts sharing a cache and OIDCCryptoPassphrase could accept a token from the cache that they would reject themselves (GHSA-gwg9-pmp9-m6wv, reported by @lyhtheori)
authentication: the user is no longer recycled from the main/previous request in sub-requests and internal redirects, so an unauthenticated user could no longer read or overwrite separately protected content via e.g. DirectoryIndex or WebDAV COPY/MOVE (GHSA-98m5-m556-8684, reported by @lyhtheori); NB: a sub-request or internal redirect into a differently configured location now re-validates the session or access token, so OIDCStripCookies on the session cookie, or an access token passed only in a POST body or query parameter, will trigger (re-)authentication there
redirect validation: only http/https URLs are accepted as redirect targets; a same-host javascript: URL passed as the target_link_uri of a 3rd-party initiated login was executed by the POST-restore page after authentication
logout: an unauthenticated front-channel logout request could terminate another user's session by passing that user's sub as the sid, when back-channel logout was enabled or the ID token carried no sid; the sub logout index now has a cache section of its own that only a back-channel logout token without a sid consults
hostname validation: hostnames (same-host redirect check, session cookie domain binding, cookie domain and discovery/request URI suffix checks) and HTTP response header names are compared byte for byte, folding ASCII case only; whitespace was ignored, so e.g. www.exam ple.com matched www.example.com
HTTP responses: memory use while receiving a response from a provider or other remote endpoint was quadratic in its size, e.g. 3 GB for a 10 MB response; with dynamic discovery and no OIDCDiscoverIssuersAllowed a client could direct such a fetch to a host of its choosing and exhaust the server's memory

Features

access token refresh: add OIDCRefreshAccessTokenInterval to refresh the access token once it is older than the configured number of seconds, regardless of its expiry; combines with OIDCRefreshAccessTokenBeforeExpiry as "whichever comes first" and does not need an expires_in hint from the OP
metrics: add cache.hit, cache.miss and cache.eviction counters; label cache.error with the cache backend name
log correlation: export a non-reversible fingerprint of the session identifier and the generated trace-id as OIDC_SESSION_ID / OIDC_TRACE_ID request notes/environment variables, for use in LogFormat/ErrorLogFormat
metrics: report subsystem self-health in the Prometheus output (oidc_build_info, oidc_metrics_flush_errors, oidc_metrics_last_flush_timestamp_seconds) and add the OIDCMetricsCacheStorageInterval / OIDCMetricsCacheJsonMax directives
metrics: turn format=status into a real readiness probe: cache backend write/read round-trip, answering 503 on failure
metrics: label the authn.response.error.protocol and authz.error.oauth20 counters with the specific validation failure reason
tracing: propagate an incoming tracestate header alongside traceparent
metrics: Prometheus timing histograms are additionally emitted as idiomatic _seconds families (le= and sum in seconds, with new 10s/30s buckets); the legacy millisecond families are deprecated and will be removed in a future release
tracing: generated traceparent headers always carry the "sampled" flag

Bugfixes

metrics: check the counter/timing type parsed out of a metrics key against the info tables and skip entries of an unknown type, instead of indexing the tables with the raw value, so a corrupt or stale shared-memory segment cannot drive an out-of-bounds read
metrics: format=json no longer resets the collected metrics by default; pass reset=true explicitly
metrics: reclaim the process-local counter/timing allocations after each successful flush, instead of leaking them in every server process for as long as it lives (with OIDCMetricsData enabled; present since 2.4.15)
metrics: abort metrics operations when their mutex cannot be acquired, escape Prometheus label values, and treat histogram le boundaries as inclusive
implicit flow: the script that posts a response_mode=fragment response to the redirect URI computed and discarded its "+" to space conversion, so form-encoded spaces were posted as literal plus signs
config: OIDCRefreshAccessTokenBeforeExpiry and OIDCRefreshAccessTokenInterval accept -1 to switch the refresh off in a nested <Location>/<Directory>; a value inherited from an enclosing one could not be overridden with "off" before
jose: ES256/ES384/ES512 signed tokens failed to verify ("could not find key with kid") when built against cjose 0.8.0 or later, whose headers no longer pull in OpenSSL; a regression in 2.4.20; thanks @cyrilst

Other

userinfo: aggregated and distributed claims (_claim_names/_claim_sources) are no longer resolved: the resolver accepted the aggregated JWTs without verifying their signatures and fetched distributed claims from whatever endpoint the response named; such responses are now passed on unresolved and a warning is logged
test: the libcheck unit test suites are portable (system temp dir, srcdir and environment helpers); the fork, symlink, permission and rlimit tests stay POSIX-only

Commercial

commercial subscription based support for large enterprise businesses is available via sales@openidc.com
licensed binary packages for various other platforms such as Microsoft Windows, Red Hat Enterprise Linux 7, older Ubuntu and Debian distros, Oracle HTTP Server 12.x/14.x and IBM HTTP Server 9.x, are available under a commercial license and agreement via sales@openidc.com
support for Redis/Valkey over TLS, Redis/Valkey (TLS) Sentinel, and Redis/Valkey (TLS) Cluster is available under a commercial license and agreement via sales@openidc.com

The RPM packages below are signed with the following RSA PGP key:

OpenIDC/mod_auth_openidc v2.4.20.4 release 2.4.20.4 on GitHub

OpenIDC/mod_auth_openidc v2.4.20.4
release 2.4.20.4

on GitHub