Make misuse harder across the OAuth, OIDC, JOSE and HTTP APIs by jviotti · Pull Request #2690 · sourcemeta/core

jviotti · 2026-07-27T19:30:09Z

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

augmentcode · 2026-07-27T19:35:16Z

🤖 Augment PR Summary

Summary: Hardens several OAuth/JOSE/OIDC utilities to reduce token/metadata confusion and make unsafe defaults harder to use.

Changes:

HTTP: clarifies cookie parsing docs and adds http_cookie_values to collect all values for a repeated cookie name.
JOSE: makes JWKSProvider::verify require explicit subject/type expectations and adds verify_access_token to enforce RFC 9068 typ for access tokens.
OAuth: promotes endpoint URL validation into exported oauth_is_endpoint_url and reuses it across metadata parsing/creation.
OIDC: adds an OIDCProviderMetadata constructor/from overload that lifts already-validated OAuthServerMetadata without reparsing.
Tests: adds focused unit tests for the new helpers and stricter verification behavior.

Technical Notes: Emphasizes explicit call-site decisions for security-sensitive checks (notably typ) and improves coverage for edge cases like repeated cookies and endpoint URL validation.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-07-27T19:35:17Z

+/// §4.2.2 notes the server "cannot determine from the Cookie header alone [...]
+/// for which hosts the cookie is valid". That section also warns that servers
+/// "SHOULD NOT rely upon the order in which these cookies appear", so a caller
+/// verifying a signed cookie tries every value rather than any single one.


src/core/http/include/sourcemeta/core/http_message.h:243: http_cookie_values forwards values as views into input (via http_parse_cookies), so collecting into std::vector<std::string_view> can easily dangle if the caller passes a temporary/short-lived buffer. Consider documenting this borrowing/lifetime constraint similarly to the container overload of http_parse_cookies.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

cubic-dev-ai

Review completed against the latest diff

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions

Benchmark (linux/gcc)

Details

Benchmark suite	Current: `75fc8d2`	Previous: `c7664ee`	Ratio
`JOSE_VerifySignature_RS256`	`22160.71527448628` ns/iter	`22228.976101451466` ns/iter	`1.00`
`JOSE_VerifySignature_ES512`	`576241.3190437005` ns/iter	`488197.767247375` ns/iter	`1.18`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`36427190.84210081` ns/iter	`29217282.55999824` ns/iter	`1.25`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4136848.905325802` ns/iter	`4682311.561538637` ns/iter	`0.88`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2043181.6111112558` ns/iter	`1856480.8377659768` ns/iter	`1.10`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`375554.9054779536` ns/iter	`348077.9626679876` ns/iter	`1.08`
`HTML_Build_Table_100000`	`64813404.81817906` ns/iter	`60818236.16667256` ns/iter	`1.07`
`HTML_Render_Table_100000`	`1821375.6213332699` ns/iter	`5021488.306451352` ns/iter	`0.36`
`JSONLD_Catalog_Annotation_List_Populate`	`1303494.9999999965` ns/iter	`1185870.9067797016` ns/iter	`1.10`
`JSONLD_Catalog_Materialize`	`6867593.211538292` ns/iter	`6495976.915887431` ns/iter	`1.06`
`JSONL_Parse_Large`	`13926216.999998359` ns/iter	`12086257.862069393` ns/iter	`1.15`
`JSONL_Parse_Large_GZIP`	`15320730.54347719` ns/iter	`13413280.749998737` ns/iter	`1.14`
`URITemplateRouter_Create`	`30269.669755759518` ns/iter	`26223.07864747436` ns/iter	`1.15`
`URITemplateRouter_Match`	`162.72393957532398` ns/iter	`158.30458587981826` ns/iter	`1.03`
`URITemplateRouter_Match_BasePath`	`184.7292261009075` ns/iter	`181.10636756824553` ns/iter	`1.02`
`URITemplateRouterView_Restore`	`8415.669407991667` ns/iter	`3641.1519356964927` ns/iter	`2.31`
`URITemplateRouterView_Match`	`127.45022081124165` ns/iter	`112.19285572386472` ns/iter	`1.14`
`URITemplateRouterView_Match_BasePath`	`150.86411222722498` ns/iter	`129.22807130091164` ns/iter	`1.17`
`URITemplateRouterView_Arguments`	`474.98978096747067` ns/iter	`444.640666751861` ns/iter	`1.07`
`JSONPath_Descendant_Filter_Nested`	`1688.4442098181066` ns/iter	`1382.388673313292` ns/iter	`1.22`
`Pointer_Object_Traverse`	`33.04179729856394` ns/iter	`27.1304489165779` ns/iter	`1.22`
`Pointer_Object_Try_Traverse`	`26.083615906788612` ns/iter	`26.750607287233844` ns/iter	`0.98`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`158.1790262011248` ns/iter	`144.738722389135` ns/iter	`1.09`
`Pointer_Walker_Schema_ISO_Language`	`2822328.873517935` ns/iter	`2514683.039426572` ns/iter	`1.12`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1894564.2197801948` ns/iter	`1952848.7262571275` ns/iter	`0.97`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1724862.7272728581` ns/iter	`1713388.5563725035` ns/iter	`1.01`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`446.3649536650717` ns/iter	`478.19592229894346` ns/iter	`0.93`
`JSON_Array_Of_Objects_Unique`	`428.75910982959175` ns/iter	`375.24370991690716` ns/iter	`1.14`
`JSON_Parse_1`	`9996.028887207232` ns/iter	`8728.28372283721` ns/iter	`1.15`
`JSON_Parse_Real`	`7911.367125010555` ns/iter	`6701.584587833872` ns/iter	`1.18`
`JSON_Parse_Decimal`	`12883.798763886694` ns/iter	`9860.725612951694` ns/iter	`1.31`
`JSON_Parse_Schema_ISO_Language`	`6962366.13861298` ns/iter	`6168332.725663647` ns/iter	`1.13`
`JSON_Parse_Integer`	`5720.085713352843` ns/iter	`4905.2376434649605` ns/iter	`1.17`
`JSON_Parse_String_NonSSO_Plain`	`11921.319635792233` ns/iter	`10470.176016714311` ns/iter	`1.14`
`JSON_Parse_String_SSO_Plain`	`4968.733415643086` ns/iter	`4430.998992395649` ns/iter	`1.12`
`JSON_Parse_String_Escape_Heavy`	`25984.023523284024` ns/iter	`23483.215110634526` ns/iter	`1.11`
`JSON_Parse_Object_Short_Keys`	`13794.805848759079` ns/iter	`12017.876008151221` ns/iter	`1.15`
`JSON_Parse_Object_Scalar_Properties`	`7122.904563764391` ns/iter	`6102.955688194033` ns/iter	`1.17`
`JSON_Parse_Object_Array_Properties`	`12052.306911824497` ns/iter	`10654.881953225737` ns/iter	`1.13`
`JSON_Parse_Object_Object_Properties`	`12327.345368474538` ns/iter	`10683.848938959734` ns/iter	`1.15`
`JSON_Parse_Nested_Containers`	`99786.25434845116` ns/iter	`91184.93061701854` ns/iter	`1.09`
`JSON_From_String_Copy`	`18.0812799561666` ns/iter	`17.33085544415288` ns/iter	`1.04`
`JSON_From_String_Temporary`	`15.35543262234815` ns/iter	`15.064207727977541` ns/iter	`1.02`
`JSON_Number_To_Double`	`20.891948362317518` ns/iter	`22.617117350508963` ns/iter	`0.92`
`JSON_Object_At_Last_Key/8`	`3.818915240546503` ns/iter	`5.275086870000223` ns/iter	`0.72`
`JSON_Object_At_Last_Key/32`	`11.897287725206146` ns/iter	`13.18635885051625` ns/iter	`0.90`
`JSON_Object_At_Last_Key/128`	`48.6332144770449` ns/iter	`79.07140488155503` ns/iter	`0.62`
`JSON_Object_At_Last_Key/512`	`356.821525311081` ns/iter	`210.32345231967503` ns/iter	`1.70`
`JSON_Fast_Hash_Helm_Chart_Lock`	`60.808288234673896` ns/iter	`64.92940281954066` ns/iter	`0.94`
`JSON_Equality_Helm_Chart_Lock`	`160.42044190210797` ns/iter	`143.80656441928883` ns/iter	`1.12`
`JSON_Divisible_By_Decimal`	`249.53979786772803` ns/iter	`239.5321231618946` ns/iter	`1.04`
`JSON_String_Equal/10`	`6.303256158971862` ns/iter	`5.326542136162324` ns/iter	`1.18`
`JSON_String_Equal/100`	`5.997341421854078` ns/iter	`6.62564962097692` ns/iter	`0.91`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.623432155003677` ns/iter	`0.9350847780959268` ns/iter	`0.67`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`25.18939828095805` ns/iter	`17.267469493615426` ns/iter	`1.46`
`JSON_String_Fast_Hash/10`	`2.2973878252325703` ns/iter	`3.3326506946307854` ns/iter	`0.69`
`JSON_String_Fast_Hash/100`	`2.296966156613638` ns/iter	`3.332992346851253` ns/iter	`0.69`
`JSON_String_Key_Hash/10`	`1.2477721848638965` ns/iter	`1.302671090192827` ns/iter	`0.96`
`JSON_String_Key_Hash/100`	`12.44088481354555` ns/iter	`13.025938983695557` ns/iter	`0.96`
`JSON_Object_Defines_Miss_Same_Length`	`3.1136099553447996` ns/iter	`3.065529652540609` ns/iter	`1.02`
`JSON_Object_Defines_Miss_Too_Small`	`3.1366680041032518` ns/iter	`3.293115912461123` ns/iter	`0.95`
`JSON_Object_Defines_Miss_Too_Large`	`3.1136502690522265` ns/iter	`2.895936487626017` ns/iter	`1.08`
`Regex_Lower_S_Or_Upper_S_Asterisk`	`0.9342444319541728` ns/iter	`1.27104352508916` ns/iter	`0.74`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`0.622938232129638` ns/iter	`0.9804371733481823` ns/iter	`0.64`
`Regex_Period_Asterisk`	`0.9340729419869555` ns/iter	`1.2479068444215868` ns/iter	`0.75`
`Regex_Group_Period_Asterisk_Group`	`0.6229859056229439` ns/iter	`0.9799809314909609` ns/iter	`0.64`
`Regex_Period_Plus`	`0.9347510654626869` ns/iter	`1.2666292784876134` ns/iter	`0.74`
`Regex_Period`	`0.6228998531081282` ns/iter	`0.9800512489385202` ns/iter	`0.64`
`Regex_Caret_Period_Plus_Dollar`	`0.944989304869682` ns/iter	`1.2744168149242723` ns/iter	`0.74`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`0.6230898203722733` ns/iter	`0.9800506588100145` ns/iter	`0.64`
`Regex_Caret_Period_Asterisk_Dollar`	`0.9344848511297633` ns/iter	`1.283781237439551` ns/iter	`0.73`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`0.6228272853996791` ns/iter	`0.980606079804457` ns/iter	`0.64`
`Regex_Caret_X_Hyphen`	`4.387807350026127` ns/iter	`3.8589839884581654` ns/iter	`1.14`
`Regex_Period_Md_Dollar`	`29.48055915063828` ns/iter	`18.326483120878624` ns/iter	`1.61`
`Regex_Caret_Slash_Period_Asterisk`	`4.669778586065816` ns/iter	`3.852832040182292` ns/iter	`1.21`
`Regex_Caret_Period_Range_Dollar`	`1.2474132071047999` ns/iter	`1.6264512786497756` ns/iter	`0.77`
`Regex_Nested_Backtrack`	`38.6300181097333` ns/iter	`34.343172615660954` ns/iter	`1.12`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (macos/llvm)

Details

Benchmark suite	Current: `75fc8d2`	Previous: `1d33310`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`2.523714771786285` ns/iter	`2.7399321322577483` ns/iter	`0.92`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`2.294738617135793` ns/iter	`3.1425230491211518` ns/iter	`0.73`
`Regex_Period_Asterisk`	`2.268535468981002` ns/iter	`3.3367863959630606` ns/iter	`0.68`
`Regex_Group_Period_Asterisk_Group`	`2.6013080828720145` ns/iter	`2.343814038380114` ns/iter	`1.11`
`Regex_Period_Plus`	`2.817002445508918` ns/iter	`3.500927166403332` ns/iter	`0.80`
`Regex_Period`	`2.658366511678823` ns/iter	`3.4210786231231727` ns/iter	`0.78`
`Regex_Caret_Period_Plus_Dollar`	`2.806806257168889` ns/iter	`2.6325135321642263` ns/iter	`1.07`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`3.1556522568326506` ns/iter	`2.1085470373722517` ns/iter	`1.50`
`Regex_Caret_Period_Asterisk_Dollar`	`2.4706288478019265` ns/iter	`1.7934571698328312` ns/iter	`1.38`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`2.3747224268819576` ns/iter	`2.0162592965530073` ns/iter	`1.18`
`Regex_Caret_X_Hyphen`	`8.486469693111092` ns/iter	`6.819780625734134` ns/iter	`1.24`
`Regex_Period_Md_Dollar`	`26.19166424305497` ns/iter	`19.57490310142039` ns/iter	`1.34`
`Regex_Caret_Slash_Period_Asterisk`	`6.526803373981251` ns/iter	`6.255099768368524` ns/iter	`1.04`
`Regex_Caret_Period_Range_Dollar`	`3.176555121845256` ns/iter	`3.1532267120184176` ns/iter	`1.01`
`Regex_Nested_Backtrack`	`39.183183947096865` ns/iter	`32.70893941835639` ns/iter	`1.20`
`JSON_Array_Of_Objects_Unique`	`483.9028795218307` ns/iter	`372.9072331198221` ns/iter	`1.30`
`JSON_Parse_1`	`9839.319776287026` ns/iter	`7346.841255467879` ns/iter	`1.34`
`JSON_Parse_Real`	`9798.219734239969` ns/iter	`8233.879744924796` ns/iter	`1.19`
`JSON_Parse_Decimal`	`10647.78652324089` ns/iter	`8112.205150400342` ns/iter	`1.31`
`JSON_Parse_Schema_ISO_Language`	`5643853.663999835` ns/iter	`4115233.1445081965` ns/iter	`1.37`
`JSON_Parse_Integer`	`6627.536138990493` ns/iter	`5408.081669999092` ns/iter	`1.23`
`JSON_Parse_String_NonSSO_Plain`	`11451.795647905985` ns/iter	`8690.526541754622` ns/iter	`1.32`
`JSON_Parse_String_SSO_Plain`	`4132.254869869113` ns/iter	`3646.0443137515454` ns/iter	`1.13`
`JSON_Parse_String_Escape_Heavy`	`29419.315099861713` ns/iter	`27702.72038756816` ns/iter	`1.06`
`JSON_Parse_Object_Short_Keys`	`12081.806831887756` ns/iter	`11622.491811919603` ns/iter	`1.04`
`JSON_Parse_Object_Scalar_Properties`	`6473.428823985379` ns/iter	`5733.142940921038` ns/iter	`1.13`
`JSON_Parse_Object_Array_Properties`	`11017.34908178229` ns/iter	`9142.922592990866` ns/iter	`1.21`
`JSON_Parse_Object_Object_Properties`	`10921.594014756853` ns/iter	`9805.204026430858` ns/iter	`1.11`
`JSON_Parse_Nested_Containers`	`89819.78371501299` ns/iter	`73855.9245299862` ns/iter	`1.22`
`JSON_From_String_Copy`	`32.87663430297615` ns/iter	`28.400128989801914` ns/iter	`1.16`
`JSON_From_String_Temporary`	`29.26395759913196` ns/iter	`23.386175856280204` ns/iter	`1.25`
`JSON_Number_To_Double`	`42.40537047825873` ns/iter	`41.61585172172986` ns/iter	`1.02`
`JSON_Object_At_Last_Key/8`	`5.394562733912793` ns/iter	`5.2137791699999525` ns/iter	`1.03`
`JSON_Object_At_Last_Key/32`	`16.776676426884826` ns/iter	`14.985704493953422` ns/iter	`1.12`
`JSON_Object_At_Last_Key/128`	`76.99164814525695` ns/iter	`64.90511559340362` ns/iter	`1.19`
`JSON_Object_At_Last_Key/512`	`253.50674113733135` ns/iter	`196.53921825088955` ns/iter	`1.29`
`JSON_Fast_Hash_Helm_Chart_Lock`	`74.68474508752732` ns/iter	`64.13340536737924` ns/iter	`1.16`
`JSON_Equality_Helm_Chart_Lock`	`210.76560959385392` ns/iter	`159.19931546393178` ns/iter	`1.32`
`JSON_Divisible_By_Decimal`	`252.4148914568186` ns/iter	`187.15294084181113` ns/iter	`1.35`
`JSON_String_Equal/10`	`9.578253689961866` ns/iter	`7.1754876674568795` ns/iter	`1.33`
`JSON_String_Equal/100`	`9.263664196310598` ns/iter	`7.2434693375444885` ns/iter	`1.28`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.4765569105289674` ns/iter	`0.3755831270242167` ns/iter	`1.27`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`4.270001729089474` ns/iter	`3.4064391116029027` ns/iter	`1.25`
`JSON_String_Fast_Hash/10`	`2.9912672701057614` ns/iter	`2.564499418639375` ns/iter	`1.17`
`JSON_String_Fast_Hash/100`	`2.7974947530979373` ns/iter	`2.4729360530492746` ns/iter	`1.13`
`JSON_String_Key_Hash/10`	`2.4647004178288716` ns/iter	`1.9680551937215347` ns/iter	`1.25`
`JSON_String_Key_Hash/100`	`3.4815464194782146` ns/iter	`2.403458535023901` ns/iter	`1.45`
`JSON_Object_Defines_Miss_Same_Length`	`3.7896078438062726` ns/iter	`2.903910775900106` ns/iter	`1.31`
`JSON_Object_Defines_Miss_Too_Small`	`3.596902314154442` ns/iter	`2.8698285413224482` ns/iter	`1.25`
`JSON_Object_Defines_Miss_Too_Large`	`3.897868251710054` ns/iter	`3.207393313154756` ns/iter	`1.22`
`Pointer_Object_Traverse`	`35.54715145450355` ns/iter	`24.543194572579885` ns/iter	`1.45`
`Pointer_Object_Try_Traverse`	`31.846398567263908` ns/iter	`23.94070760421489` ns/iter	`1.33`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`251.18756879531426` ns/iter	`175.7290215133521` ns/iter	`1.43`
`Pointer_Walker_Schema_ISO_Language`	`4358975.902702598` ns/iter	`3009648.8589212084` ns/iter	`1.45`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1847299.1071429793` ns/iter	`1331792.630057792` ns/iter	`1.39`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1542641.8041957594` ns/iter	`1067877.7427259479` ns/iter	`1.44`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`475.14810994499464` ns/iter	`345.10967234058904` ns/iter	`1.38`
`JSONPath_Descendant_Filter_Nested`	`1803.9532701436906` ns/iter	`1334.5643524851325` ns/iter	`1.35`
`URITemplateRouter_Create`	`34624.83303276209` ns/iter	`24268.270834046267` ns/iter	`1.43`
`URITemplateRouter_Match`	`245.59554121500068` ns/iter	`184.44661061620621` ns/iter	`1.33`
`URITemplateRouter_Match_BasePath`	`286.26308307834904` ns/iter	`226.39065032991076` ns/iter	`1.26`
`URITemplateRouterView_Restore`	`16608.23003950846` ns/iter	`11570.360225260649` ns/iter	`1.44`
`URITemplateRouterView_Match`	`191.58878876985958` ns/iter	`149.819067683255` ns/iter	`1.28`
`URITemplateRouterView_Match_BasePath`	`221.33738018239842` ns/iter	`166.66088211675253` ns/iter	`1.33`
`URITemplateRouterView_Arguments`	`698.9881975842726` ns/iter	`585.5255729237962` ns/iter	`1.19`
`JSONL_Parse_Large`	`14604679.815788228` ns/iter	`12486159.214284549` ns/iter	`1.17`
`JSONL_Parse_Large_GZIP`	`18053242.878048565` ns/iter	`12744178.018182207` ns/iter	`1.42`
`JSONLD_Catalog_Annotation_List_Populate`	`1345590.4489435926` ns/iter	`928338.6548913001` ns/iter	`1.45`
`JSONLD_Catalog_Materialize`	`6859329.821052023` ns/iter	`5047910.410000895` ns/iter	`1.36`
`HTML_Build_Table_100000`	`56792733.3000057` ns/iter	`38394888.88888809` ns/iter	`1.48`
`HTML_Render_Table_100000`	`2498182.7050359724` ns/iter	`1829107.0000001732` ns/iter	`1.37`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`35158315.78947296` ns/iter	`28130726.680001315` ns/iter	`1.25`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4762674.618421527` ns/iter	`3660693.014706219` ns/iter	`1.30`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2300123.2145212097` ns/iter	`1870120.249337025` ns/iter	`1.23`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`366394.72897698253` ns/iter	`296881.33019756153` ns/iter	`1.23`
`JOSE_VerifySignature_RS256`	`31681.14054440949` ns/iter	`24455.548233627516` ns/iter	`1.30`
`JOSE_VerifySignature_ES512`	`1523885.3733905843` ns/iter	`1221669.1973018274` ns/iter	`1.25`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (linux/llvm)

Details

Benchmark suite	Current: `75fc8d2`	Previous: `c7664ee`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`2.179144176716097` ns/iter	`2.463547524300886` ns/iter	`0.88`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`2.1799167583869785` ns/iter	`2.4628476004242272` ns/iter	`0.89`
`Regex_Period_Asterisk`	`2.1788672800332107` ns/iter	`2.462892000115387` ns/iter	`0.88`
`Regex_Group_Period_Asterisk_Group`	`2.18016184212559` ns/iter	`2.466153378175058` ns/iter	`0.88`
`Regex_Period_Plus`	`2.4900555976578387` ns/iter	`3.5170485727845486` ns/iter	`0.71`
`Regex_Period`	`2.8000133621768` ns/iter	`3.869137428238969` ns/iter	`0.72`
`Regex_Caret_Period_Plus_Dollar`	`2.800473811915442` ns/iter	`3.868456262927684` ns/iter	`0.72`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`2.4916895284016647` ns/iter	`3.5176238346003648` ns/iter	`0.71`
`Regex_Caret_Period_Asterisk_Dollar`	`2.401640106886445` ns/iter	`2.684868679372328` ns/iter	`0.89`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`2.1797766450018194` ns/iter	`2.8147519350946983` ns/iter	`0.77`
`Regex_Caret_X_Hyphen`	`5.61580269937455` ns/iter	`7.161209688032126` ns/iter	`0.78`
`Regex_Period_Md_Dollar`	`27.464586693905794` ns/iter	`26.21172658184849` ns/iter	`1.05`
`Regex_Caret_Slash_Period_Asterisk`	`5.603290374927005` ns/iter	`7.382207032111888` ns/iter	`0.76`
`Regex_Caret_Period_Range_Dollar`	`3.114292614361694` ns/iter	`4.578186409313775` ns/iter	`0.68`
`Regex_Nested_Backtrack`	`38.672446529422245` ns/iter	`38.93469323366218` ns/iter	`0.99`
`JSON_Array_Of_Objects_Unique`	`410.8705447261842` ns/iter	`436.96371880970014` ns/iter	`0.94`
`JSON_Parse_1`	`4842.410157122056` ns/iter	`4686.535802898484` ns/iter	`1.03`
`JSON_Parse_Real`	`5228.685140850267` ns/iter	`5206.850104011438` ns/iter	`1.00`
`JSON_Parse_Decimal`	`7520.2541428154545` ns/iter	`7540.441034397387` ns/iter	`1.00`
`JSON_Parse_Schema_ISO_Language`	`3488122.582089136` ns/iter	`3588682.0717952363` ns/iter	`0.97`
`JSON_Parse_Integer`	`3777.794968444626` ns/iter	`3879.7946670372485` ns/iter	`0.97`
`JSON_Parse_String_NonSSO_Plain`	`5062.055867050307` ns/iter	`5069.8701592574425` ns/iter	`1.00`
`JSON_Parse_String_SSO_Plain`	`2702.5310212363697` ns/iter	`2761.884558437331` ns/iter	`0.98`
`JSON_Parse_String_Escape_Heavy`	`14157.321378171446` ns/iter	`14481.76568615322` ns/iter	`0.98`
`JSON_Parse_Object_Short_Keys`	`11018.502258171404` ns/iter	`7934.5231372457665` ns/iter	`1.39`
`JSON_Parse_Object_Scalar_Properties`	`4175.111464740404` ns/iter	`4018.544268347888` ns/iter	`1.04`
`JSON_Parse_Object_Array_Properties`	`5481.298724740656` ns/iter	`5540.641258370982` ns/iter	`0.99`
`JSON_Parse_Object_Object_Properties`	`5475.456076543151` ns/iter	`5423.263498802631` ns/iter	`1.01`
`JSON_Parse_Nested_Containers`	`46335.55756283417` ns/iter	`44766.75434559654` ns/iter	`1.04`
`JSON_From_String_Copy`	`19.320054807895993` ns/iter	`21.112236081477235` ns/iter	`0.92`
`JSON_From_String_Temporary`	`17.153251785631344` ns/iter	`18.311963231102272` ns/iter	`0.94`
`JSON_Number_To_Double`	`23.686496267678876` ns/iter	`22.583214832764195` ns/iter	`1.05`
`JSON_Object_At_Last_Key/8`	`3.863251818323923` ns/iter	`4.001527815705932` ns/iter	`0.97`
`JSON_Object_At_Last_Key/32`	`12.181185802962261` ns/iter	`13.093465030633006` ns/iter	`0.93`
`JSON_Object_At_Last_Key/128`	`48.59022202847107` ns/iter	`56.62786356743683` ns/iter	`0.86`
`JSON_Object_At_Last_Key/512`	`399.08156241880783` ns/iter	`370.8723783249958` ns/iter	`1.08`
`JSON_Fast_Hash_Helm_Chart_Lock`	`60.65706150103397` ns/iter	`73.19591398634424` ns/iter	`0.83`
`JSON_Equality_Helm_Chart_Lock`	`153.4187562375867` ns/iter	`165.13967875456092` ns/iter	`0.93`
`JSON_Divisible_By_Decimal`	`249.1703554701908` ns/iter	`255.3365194285396` ns/iter	`0.98`
`JSON_String_Equal/10`	`5.921026777354734` ns/iter	`5.631779381347055` ns/iter	`1.05`
`JSON_String_Equal/100`	`6.541983657773413` ns/iter	`6.334720868405854` ns/iter	`1.03`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.9411239225155927` ns/iter	`1.0567618170907884` ns/iter	`0.89`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`14.932298675921965` ns/iter	`12.438914243027844` ns/iter	`1.20`
`JSON_String_Fast_Hash/10`	`2.8075742214366812` ns/iter	`2.815359824467091` ns/iter	`1.00`
`JSON_String_Fast_Hash/100`	`2.813382106415377` ns/iter	`2.825099613527238` ns/iter	`1.00`
`JSON_String_Key_Hash/10`	`2.761609889862995` ns/iter	`2.4627706476376954` ns/iter	`1.12`
`JSON_String_Key_Hash/100`	`9.025423464802628` ns/iter	`7.737566801045375` ns/iter	`1.17`
`JSON_Object_Defines_Miss_Same_Length`	`3.0586065885616613` ns/iter	`3.199488394341148` ns/iter	`0.96`
`JSON_Object_Defines_Miss_Too_Small`	`3.425948780829468` ns/iter	`4.2222753395368295` ns/iter	`0.81`
`JSON_Object_Defines_Miss_Too_Large`	`2.7226523297816225` ns/iter	`3.0114260113825218` ns/iter	`0.90`
`Pointer_Object_Traverse`	`37.76175118873308` ns/iter	`30.64565909668132` ns/iter	`1.23`
`Pointer_Object_Try_Traverse`	`41.73153126525274` ns/iter	`33.149172173200846` ns/iter	`1.26`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`215.51255837528677` ns/iter	`174.8998224430266` ns/iter	`1.23`
`Pointer_Walker_Schema_ISO_Language`	`2682926.272030471` ns/iter	`2881708.33467729` ns/iter	`0.93`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1299642.5807049016` ns/iter	`1269629.2671480873` ns/iter	`1.02`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1629406.5939673558` ns/iter	`1585719.6795454086` ns/iter	`1.03`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`689.700912413596` ns/iter	`714.2463409550458` ns/iter	`0.97`
`JSONPath_Descendant_Filter_Nested`	`1595.975150943161` ns/iter	`1578.9669648722954` ns/iter	`1.01`
`URITemplateRouter_Create`	`32177.821381595404` ns/iter	`31222.12676661421` ns/iter	`1.03`
`URITemplateRouter_Match`	`172.82053397735578` ns/iter	`183.17377606663726` ns/iter	`0.94`
`URITemplateRouter_Match_BasePath`	`199.9236512124582` ns/iter	`210.2515576470925` ns/iter	`0.95`
`URITemplateRouterView_Restore`	`8521.129847343313` ns/iter	`9839.476058321248` ns/iter	`0.87`
`URITemplateRouterView_Match`	`142.75318807742246` ns/iter	`144.01072453487245` ns/iter	`0.99`
`URITemplateRouterView_Match_BasePath`	`167.9865537777154` ns/iter	`166.21596504232443` ns/iter	`1.01`
`URITemplateRouterView_Arguments`	`439.31078739098456` ns/iter	`450.24736018651976` ns/iter	`0.98`
`JSONL_Parse_Large`	`9731368.680555698` ns/iter	`8958480.358973457` ns/iter	`1.09`
`JSONL_Parse_Large_GZIP`	`11293259.677419458` ns/iter	`10658075.681819258` ns/iter	`1.06`
`JSONLD_Catalog_Annotation_List_Populate`	`1226695.776614277` ns/iter	`1267732.2007169188` ns/iter	`0.97`
`JSONLD_Catalog_Materialize`	`4269335.159509017` ns/iter	`4216745.199999589` ns/iter	`1.01`
`HTML_Build_Table_100000`	`69268031.69999403` ns/iter	`74865363.11110587` ns/iter	`0.93`
`HTML_Render_Table_100000`	`5520428.244094582` ns/iter	`5044563.227941393` ns/iter	`1.09`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`33419188.476186503` ns/iter	`35750755.099996924` ns/iter	`0.93`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4145097.3313609893` ns/iter	`4272205.6585362` ns/iter	`0.97`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`1889701.008130042` ns/iter	`2137426.308868674` ns/iter	`0.88`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`351520.6015075494` ns/iter	`276529.98696166434` ns/iter	`1.27`
`JOSE_VerifySignature_RS256`	`56958.95579975914` ns/iter	`63864.43742584014` ns/iter	`0.89`
`JOSE_VerifySignature_ES512`	`2412009.5551724858` ns/iter	`2661010.1939161313` ns/iter	`0.91`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (windows/msvc)

Details

Benchmark suite	Current: `75fc8d2`	Previous: `c7664ee`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`5.388174999999202` ns/iter	`2.516415511145745` ns/iter	`2.14`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`5.018062999999984` ns/iter	`2.5222089285713474` ns/iter	`1.99`
`Regex_Period_Asterisk`	`5.027823999998873` ns/iter	`2.505392500000068` ns/iter	`2.01`
`Regex_Group_Period_Asterisk_Group`	`5.025748999998996` ns/iter	`2.470517500000012` ns/iter	`2.03`
`Regex_Period_Plus`	`5.076129000001401` ns/iter	`2.7032071428574715` ns/iter	`1.88`
`Regex_Period`	`5.333221428571733` ns/iter	`2.682330357142908` ns/iter	`1.99`
`Regex_Caret_Period_Plus_Dollar`	`5.017449999998901` ns/iter	`2.5850211360852184` ns/iter	`1.94`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`5.345175999998446` ns/iter	`2.592650265542197` ns/iter	`2.06`
`Regex_Caret_Period_Asterisk_Dollar`	`5.330244000001585` ns/iter	`2.636643836931371` ns/iter	`2.02`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`5.020377999999255` ns/iter	`2.6068084574942034` ns/iter	`1.93`
`Regex_Caret_X_Hyphen`	`8.48518861607163` ns/iter	`4.197110624998857` ns/iter	`2.02`
`Regex_Period_Md_Dollar`	`44.6582388869834` ns/iter	`21.621408771714187` ns/iter	`2.07`
`Regex_Caret_Slash_Period_Asterisk`	`7.852493303569678` ns/iter	`4.19898093562535` ns/iter	`1.87`
`Regex_Caret_Period_Range_Dollar`	`5.980449107141794` ns/iter	`2.817633614813522` ns/iter	`2.12`
`Regex_Nested_Backtrack`	`55.15789285713676` ns/iter	`28.083780678196877` ns/iter	`1.96`
`JSON_Array_Of_Objects_Unique`	`599.3803999999727` ns/iter	`302.3864930372697` ns/iter	`1.98`
`JSON_Parse_1`	`8974.463953286839` ns/iter	`5543.415000001914` ns/iter	`1.62`
`JSON_Parse_Real`	`16159.535714288202` ns/iter	`9149.668528265616` ns/iter	`1.77`
`JSON_Parse_Decimal`	`12716.832737357106` ns/iter	`6451.395089287968` ns/iter	`1.97`
`JSON_Parse_Schema_ISO_Language`	`8543852.000002516` ns/iter	`5251746.42857199` ns/iter	`1.63`
`JSON_Parse_Integer`	`6246.521428571278` ns/iter	`3521.1072698342577` ns/iter	`1.77`
`JSON_Parse_String_NonSSO_Plain`	`7995.311383928489` ns/iter	`5126.761000001352` ns/iter	`1.56`
`JSON_Parse_String_SSO_Plain`	`3720.753534369245` ns/iter	`2414.745519256884` ns/iter	`1.54`
`JSON_Parse_String_Escape_Heavy`	`21642.218749995835` ns/iter	`12284.919642857922` ns/iter	`1.76`
`JSON_Parse_Object_Short_Keys`	`13351.53928571588` ns/iter	`7635.767857142436` ns/iter	`1.75`
`JSON_Parse_Object_Scalar_Properties`	`6892.849999999839` ns/iter	`4043.619564965472` ns/iter	`1.70`
`JSON_Parse_Object_Array_Properties`	`11488.771428572265` ns/iter	`6458.889285714316` ns/iter	`1.78`
`JSON_Parse_Object_Object_Properties`	`11880.775000000605` ns/iter	`6526.330357142943` ns/iter	`1.82`
`JSON_Parse_Nested_Containers`	`81667.39955355646` ns/iter	`45842.41325738019` ns/iter	`1.78`
`JSON_From_String_Copy`	`67.48463169642552` ns/iter	`38.895491071423905` ns/iter	`1.74`
`JSON_From_String_Temporary`	`60.45014285713737` ns/iter	`43.432319469290924` ns/iter	`1.39`
`JSON_Number_To_Double`	`126.21539285711542` ns/iter	`61.067642857141536` ns/iter	`2.07`
`JSON_Object_At_Last_Key/8`	`7.526314285714518` ns/iter	`3.389293130296263` ns/iter	`2.22`
`JSON_Object_At_Last_Key/32`	`24.60636250000192` ns/iter	`10.148857990405347` ns/iter	`2.42`
`JSON_Object_At_Last_Key/128`	`91.19222807175314` ns/iter	`48.25068315904943` ns/iter	`1.89`
`JSON_Object_At_Last_Key/512`	`440.02724999998577` ns/iter	`149.14875673442884` ns/iter	`2.95`
`JSON_Fast_Hash_Helm_Chart_Lock`	`104.2342031250243` ns/iter	`54.6227946428449` ns/iter	`1.91`
`JSON_Equality_Helm_Chart_Lock`	`236.34399999999852` ns/iter	`103.02030343658294` ns/iter	`2.29`
`JSON_Divisible_By_Decimal`	`300.12663837871514` ns/iter	`172.0357637524161` ns/iter	`1.74`
`JSON_String_Equal/10`	`10.626625000000445` ns/iter	`5.613588392857796` ns/iter	`1.89`
`JSON_String_Equal/100`	`12.161180357143815` ns/iter	`5.593556249999259` ns/iter	`2.17`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`2.571341448597027` ns/iter	`1.1506245312499885` ns/iter	`2.23`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`14.319390625000697` ns/iter	`7.244883035714419` ns/iter	`1.98`
`JSON_String_Fast_Hash/10`	`6.625181250001333` ns/iter	`3.484260797348602` ns/iter	`1.90`
`JSON_String_Fast_Hash/100`	`6.617967633929364` ns/iter	`3.396406154648628` ns/iter	`1.95`
`JSON_String_Key_Hash/10`	`5.345080000001872` ns/iter	`2.5516571428576236` ns/iter	`2.09`
`JSON_String_Key_Hash/100`	`11.945985714285305` ns/iter	`5.851141071427638` ns/iter	`2.04`
`JSON_Object_Defines_Miss_Same_Length`	`3.802780462807391` ns/iter	`1.806891965899036` ns/iter	`2.10`
`JSON_Object_Defines_Miss_Too_Small`	`4.121344739503077` ns/iter	`1.9575329923826328` ns/iter	`2.11`
`JSON_Object_Defines_Miss_Too_Large`	`3.7833337432430207` ns/iter	`1.8000193762050747` ns/iter	`2.10`
`Pointer_Object_Traverse`	`68.8707142857124` ns/iter	`32.19066612798132` ns/iter	`2.14`
`Pointer_Object_Try_Traverse`	`71.58288392856451` ns/iter	`32.31112081735721` ns/iter	`2.22`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`198.53029451162678` ns/iter	`186.00740946492755` ns/iter	`1.07`
`Pointer_Walker_Schema_ISO_Language`	`10775412.49999925` ns/iter	`8633157.77777795` ns/iter	`1.25`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`2458544.3181816763` ns/iter	`1358887.1485948053` ns/iter	`1.81`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`3646850.256410079` ns/iter	`2190495.9375000033` ns/iter	`1.66`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`567.9481026787313` ns/iter	`374.37276224882123` ns/iter	`1.52`
`JSONPath_Descendant_Filter_Nested`	`2382.4601366746006` ns/iter	`1404.339484670013` ns/iter	`1.70`
`URITemplateRouter_Create`	`41065.14421682026` ns/iter	`23516.429504128428` ns/iter	`1.75`
`URITemplateRouter_Match`	`233.70502972036508` ns/iter	`117.63941071429988` ns/iter	`1.99`
`URITemplateRouter_Match_BasePath`	`266.7808221777177` ns/iter	`128.30258928573812` ns/iter	`2.08`
`URITemplateRouterView_Restore`	`32894.30367314287` ns/iter	`13843.585519708264` ns/iter	`2.38`
`URITemplateRouterView_Match`	`180.75952506780723` ns/iter	`84.82025669643686` ns/iter	`2.13`
`URITemplateRouterView_Match_BasePath`	`205.979825625878` ns/iter	`99.44814062500029` ns/iter	`2.07`
`URITemplateRouterView_Arguments`	`533.9199000000008` ns/iter	`335.47209929252716` ns/iter	`1.59`
`JSONL_Parse_Large`	`32992219.04761734` ns/iter	`21486444.117646683` ns/iter	`1.54`
`JSONL_Parse_Large_GZIP`	`33796847.61905212` ns/iter	`22335349.999994993` ns/iter	`1.51`
`JSONLD_Catalog_Annotation_List_Populate`	`2681784.337348663` ns/iter	`1795841.5549598758` ns/iter	`1.49`
`JSONLD_Catalog_Materialize`	`7678312.222224628` ns/iter	`6034691.964286156` ns/iter	`1.27`
`HTML_Build_Table_100000`	`89448171.42859003` ns/iter	`53292681.81817911` ns/iter	`1.68`
`HTML_Render_Table_100000`	`7827261.607143247` ns/iter	`6034441.964284756` ns/iter	`1.30`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`36648557.89473844` ns/iter	`20257602.94117497` ns/iter	`1.81`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`10110484.000000117` ns/iter	`6378391.071428219` ns/iter	`1.59`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2107551.304348105` ns/iter	`1375977.499999895` ns/iter	`1.53`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`622900.8035713183` ns/iter	`417797.33023788064` ns/iter	`1.49`
`JOSE_VerifySignature_RS256`	`21337.058209041727` ns/iter	`12249.01785714597` ns/iter	`1.74`
`JOSE_VerifySignature_ES512`	`1546920.9821427553` ns/iter	`844644.7544641395` ns/iter	`1.83`

This comment was automatically generated by workflow using github-action-benchmark.

Misc OAuth/JOSE/OIDC hardening

672ec89

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

jviotti force-pushed the auth-extra branch from 91cad44 to 672ec89 Compare July 27, 2026 19:32

jviotti changed the title ~~Misc OAuth/JOSE/OIDC hardening~~ Make misuse harder across the OAuth, OIDC, JOSE and HTTP APIs Jul 27, 2026

augmentcode Bot reviewed Jul 27, 2026

View reviewed changes

Fix

bc0e0a6

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

cubic-dev-ai Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread src/core/http/include/sourcemeta/core/http_message.h

More

75fc8d2

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

jviotti merged commit 1d33310 into main Jul 27, 2026
12 checks passed

jviotti deleted the auth-extra branch July 27, 2026 19:48

github-actions Bot reviewed Jul 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Make misuse harder across the OAuth, OIDC, JOSE and HTTP APIs - #2690

Make misuse harder across the OAuth, OIDC, JOSE and HTTP APIs#2690
jviotti merged 3 commits into
mainfrom
auth-extra

jviotti commented Jul 27, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

augmentcode Bot commented Jul 27, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Jul 27, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

jviotti commented Jul 27, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

augmentcode Bot commented Jul 27, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (linux/gcc)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (macos/llvm)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (linux/llvm)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (windows/msvc)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jviotti commented Jul 27, 2026 •

edited by cubic-dev-ai Bot

Loading

augmentcode Bot Jul 27, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading