Security context

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

security/providers/oidc/src/main/java/io/helidon/security/providers/oidc/OidcFeature.java: most-fixed (2 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The JWT provider previously suffered from critical logic flaws where signature verification and claim validation (such as audience, issuer, and expiration checks) could be decoupled or bypassed entirely when signature verification was disabled, allowing arbitrary identity spoofing.

Auth Bypass: WebClient and TLS configuration components were susceptible to socket configuration vulnerabilities, such as lack of SNI verification and inadequate connection-key isolation, which could lead to incorrect endpoint verification and key reuse across distinct host identities.

HTTP Response Splitting: Insufficient response header validation allowed HTTP response splitting and header injection. Similar validation gaps existed in security providers where OIDC logout state parameters were reflected in response headers without sanitization.