Re: [PoC] Federated Authn/z with OAUTHBEARER

On Fri, Oct 18, 2024 at 4:38 AM Daniel Gustafsson <daniel@yesql.se> wrote:
> In validate() it seems to me we should clear out ret->authn_id on failure to
> pair belts with suspenders. Fixed by calling explicit_bzero on it in the error
> path.

The new hunk says:

> cleanup:
>     /*
>      * Clear and free the validation result from the validator module once
>      * we're done with it to avoid accidental re-use.
>      */
>     if (ret->authn_id != NULL)
>     {
>         explicit_bzero(ret->authn_id, strlen(ret->authn_id));
>         pfree(ret->authn_id);
>     }
>     pfree(ret);

But I'm not clear on what's being protected against. Which code would
reuse this result?

Thanks,
--Jacob