view release on metacpan or  search on metacpan

lib/Catalyst/Plugin/OpenIDConnect/Controller/Root.pm  view on Meta::CPAN

package Catalyst::Plugin::OpenIDConnect::Controller::Root;

use Moose;
use namespace::autoclean;

BEGIN { extends 'Catalyst::Controller'; }

use JSON::MaybeXS qw(encode_json decode_json);
use MIME::Base64 qw(encode_base64 decode_base64 encode_base64url);
use Digest::SHA qw(sha256);
use Crypt::PK::RSA;
use Crypt::Misc qw(slow_eq);
use URI;
use DateTime;
use Try::Tiny;
use Data::UUID;

# Set the namespace for OpenIDConnect routes
__PACKAGE__->config(namespace => 'openidconnect');

# Module-level UUID generator for refresh token JTI claims (MED-1).
my $_uuid = Data::UUID->new();

=head1 NAME

Catalyst::Plugin::OpenIDConnect::Controller::Root - OIDC Protocol Endpoints

=head1 SYNOPSIS

Handles OpenID Connect protocol endpoints:

    /.well-known/openid-configuration - Discovery endpoint
    /openidconnect/authorize     - Authorization endpoint
    /openidconnect/token         - Token endpoint
    /openidconnect/userinfo      - UserInfo endpoint  
    /openidconnect/logout        - Logout endpoint
    /openidconnect/jwks          - JWKS endpoint for key discovery

=cut

=head1 DESCRIPTION

This controller implements the core OpenID Connect protocol endpoints.  To use it in your application, create a controller that extends this one:

    package MyApp::Controller::Auth;
    use Moose;
    use namespace::autoclean;

    BEGIN { extends 'Catalyst::Plugin::OpenIDConnect::Controller::Root'; }

    __PACKAGE__->meta->make_immutable;

=head1 METHODS

=head2 begin

Called automatically before every action in this controller.  Sets HTTP
security headers that must be present on all OIDC endpoint responses.

=cut

sub begin : Private {
    my ( $self, $c ) = @_;

    # RFC 6749 §5.1 requires Cache-Control: no-store on token responses;
    # applied globally so new endpoints can't accidentally omit it.
    # Pragma: no-cache is the HTTP/1.0 equivalent.
    $c->response->header( 'Cache-Control'          => 'no-store' );
    $c->response->header( 'Pragma'                 => 'no-cache' );

    # Prevent MIME sniffing.
    $c->response->header( 'X-Content-Type-Options' => 'nosniff' );

    # Clickjacking protection on the authorize endpoint HTML page.
    # Both headers are set for broadest browser compatibility (MED-6).