Re: [PoC] Federated Authn/z with OAUTHBEARER

On Fri, Oct 18, 2024 at 4:38 AM Daniel Gustafsson <daniel(at)yesql(dot)se> wrote:
> In validate() it seems to me we should clear out ret->authn_id on failure to
> pair belts with suspenders. Fixed by calling explicit_bzero on it in the error
> path.

The new hunk says:

> cleanup:
> /*
> * Clear and free the validation result from the validator module once
> * we're done with it to avoid accidental re-use.
> */
> if (ret->authn_id != NULL)
> {
> explicit_bzero(ret->authn_id, strlen(ret->authn_id));
> pfree(ret->authn_id);
> }
> pfree(ret);

But I'm not clear on what's being protected against. Which code would
reuse this result?

Thanks,
--Jacob