startOidcLogin wraps discovery, registration and authorization-URL generation in one try, and its catch unconditionally calls invalidateCachedClient(issuer). The comment says this
is for a stale client id, but the same branch fires for a transient network error, an offline
discovery fetch, or a crypto.randomUUID failure. Each retry then performs a fresh MSC2966 dynamic
registration, accumulating throwaway OAuth clients at the provider — which is exactly the pattern
MAS/Authelia rate-limit.
How to trigger
go offline (or block the issuer's .well-known), press "Continue with SSO" a few times, come back online — each attempt registered a new client id.
Suggested fix
only invalidate on an authorization/registration rejection that indicates a bad client
(invalid_client, HTTP 400/401 from the registration or authorize step); leave the cache alone for
network/discovery failures.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** bug · **Confidence:** high
**Location:** `src/app/pages/auth/oidc/oidcLoginUtil.ts:29-49`, `src/app/pages/auth/oidc/oidcState.ts:35-40`
### Problem
`startOidcLogin` wraps discovery, registration and authorization-URL generation in one
`try`, and its `catch` unconditionally calls `invalidateCachedClient(issuer)`. The comment says this
is for a stale client id, but the same branch fires for a transient network error, an offline
discovery fetch, or a `crypto.randomUUID` failure. Each retry then performs a fresh MSC2966 dynamic
registration, accumulating throwaway OAuth clients at the provider — which is exactly the pattern
MAS/Authelia rate-limit.
### How to trigger
go offline (or block the issuer's `.well-known`), press "Continue with SSO" a few times, come back online — each attempt registered a new client id.
### Suggested fix
only invalidate on an authorization/registration rejection that indicates a bad client
(`invalid_client`, HTTP 400/401 from the registration or authorize step); leave the cache alone for
network/discovery failures.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:23 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: bug · Confidence: high
Location:
src/app/pages/auth/oidc/oidcLoginUtil.ts:29-49,src/app/pages/auth/oidc/oidcState.ts:35-40Problem
startOidcLoginwraps discovery, registration and authorization-URL generation in onetry, and itscatchunconditionally callsinvalidateCachedClient(issuer). The comment says thisis for a stale client id, but the same branch fires for a transient network error, an offline
discovery fetch, or a
crypto.randomUUIDfailure. Each retry then performs a fresh MSC2966 dynamicregistration, accumulating throwaway OAuth clients at the provider — which is exactly the pattern
MAS/Authelia rate-limit.
How to trigger
go offline (or block the issuer's
.well-known), press "Continue with SSO" a few times, come back online — each attempt registered a new client id.Suggested fix
only invalidate on an authorization/registration rejection that indicates a bad client
(
invalid_client, HTTP 400/401 from the registration or authorize step); leave the cache alone fornetwork/discovery failures.
Filed from the September 2026 client audit (branch
lotus@4bea4895).