Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Release Notes
00.79.30

00.79.30

Available on Maven Central. A security-hardening tick closing all 28 findings of the 2026-07-02 source-review security audit (0 Critical, 0 High, 4 Medium, 15 Low, 9 Info). No new feature, no new module. Additive and behaviour-preserving for correctly-configured consumers — the two intentional behaviour changes both remove a fail-open footgun and only affect mis-configured code. Followed by two further hardening ticks — 00.79.40 and 00.79.41 (current release).

Release date: 2026-07-02 Previous release: 00.79.20 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.79.30 Full changelog: GitHub release v00.79.30

Five themes

  1. Session integrity — LoginView now rotates the session id on every login regardless of the SessionPolicy decision (CWE-384); a mid-session role/permission revocation actually terminates the cached subject, not just deflects one navigation (CWE-613).
  2. Audit PII — the two remaining session-audit paths derive subjectId via the registered SubjectIdResolver, never subject.toString() (CWE-532).
  3. JWT / OIDC / DPoP spec-fidelity — HttpJwksClient throttles an unauthenticated unknown-kid refresh flood; the JWKS trust root is https-enforced at the client boundary; crit headers are rejected uniformly across all algorithm families; an OIDC-layer iss/aud backstop is enforced; DPoP htu/ath handling is tightened; back-channel-logout replay protection is on by default.
  4. Fail-closed defaults — empty @RequiresPermission({}) and empty-role evaluators now fail closed (were fail-open); CRLF is rejected at the step-up and event-decode trust boundaries; propagation caches are scope-keyed and bounded; on-disk stores are owner-only where the platform allows.
  5. Honest guarantees — JavaDoc that over-stated the JtiStore, dummy-KDF timing, and login-attempt-lockout guarantees was corrected so it no longer drives insecure deployment decisions.

Deliberate behaviour changes

Both close a fail-open footgun and only affect mis-configured code:

  • RoleBasedAccessEvaluator with an empty required-role set now requires an authenticated subject (was: anyone).
  • @RequiresPermission({}) now denies (was: any authenticated subject).
  • DefaultLogoutTokenValidator(JwtValidator) installs an in-memory jti store by default — replay protection on; a multi-node RP passes a shared store via the 2-arg constructor.
  • IdTokenValidationError gains two additive sealed variants: IssuerMismatch, AudienceMismatch.

Findings closed (28)

Severity distribution: 0 Critical · 0 High · 4 Medium · 15 Low · 9 Info. Highlights (full detail in the GitHub release):

  • Medium — session-id rotation on every login (JS-SEC-003); drift-triggered subject eviction, not just navigation deflection (JS-SEC-002); SubjectIdResolver-derived audit ids (JS-SEC-004); JWKS unknown-kid refresh throttling (JS-SEC-001).
  • Low — https-enforced JWKS trust root; fail-closed empty-constraint evaluators; CRLF rejection at trust boundaries; control-char scrubbing in event-decode error logs; OIDC iss/aud backstop; bounded introspection cache; owner-only file/dir permissions for the bootstrap token store and Eclipse-Store tree; bounded, scope-keyed token-exchange cache; corrected over-claimed JavaDoc (DPoP jti store, dummy-KDF timing, login-attempt policy scope).
  • Info — unified crit-header rejection; DPoP htu raw-path handling; DPoP fails closed on ath-without-token; CORS lint for the credentialed "null" origin; documented recorded-not-wired decision-mapper hooks; one-time drift-detection-inert WARN; OIDC logout clears the local subject by default; documented allow-by-omission authorization model.

Exit production-review

A three-reviewer adversarial review of the full 28-fix delta returned a clean verdict — no High/Medium regression, no new fail-open, no failure-hiding exception swallow. Two findings on delivered paths, both fixed in-cycle: an over-claimed HttpJwksClient JavaDoc softened (rotation can be delayed ≤ 20 s in a narrow window, bounded and self-limiting), and AbstractOidcLogoutView reordered so the OP logout request builds while the subject is still bound.

What it does not do

No opt-in deny-by-default authorization mode; no auto-wiring of a custom RestDecisionMapper / RestErrorBodyStrategy; no per-outcome cost-floor for the mixed-algorithm timing caveat (forced-rehash migration is the mitigation); no shared-atomic jti store for single-JVM DPoP (Redis/JDBC remains the production recommendation for multi-node). All documented as backlog for a future maintenance tick.

Quality

jSentinel-core (the most-touched module) re-measured at 84 % (2156/2566) mutation / 89 % line. Every actionable finding shipped a new real-implementation regression test and no test was removed, so mutation coverage cannot regress by construction; other touched modules (jSentinel-vaadin, -jwt, -oauth2, -identity-oidc, -dpop, -propagation-oidc, -events-rest, -persistence-eclipsestore, -dx, -dx-rest, -identity-oidc-vaadin) retain their prior baseline for the same reason. Full reactor clean install green; standards pass already-compliant. No mocks.

Migration

None beyond the two deliberate fail-closed changes above — both only affect configurations that were relying on the fail-open behaviour. Just bump the version to 00.79.30.

00.79.2000.79.40