From 46e2607aebd016e69a7de5534984185c854ed8d8 Mon Sep 17 00:00:00 2001 From: Ginger Date: Tue, 9 Jun 2026 14:54:57 -0400 Subject: [PATCH] fix: Use a LRU cache for storing pending auth code grants --- src/service/oauth/mod.rs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/service/oauth/mod.rs b/src/service/oauth/mod.rs index 0ea0a85f2..cde2f0d75 100644 --- a/src/service/oauth/mod.rs +++ b/src/service/oauth/mod.rs @@ -11,6 +11,7 @@ use conduwuit::{ }; use database::{Deserialized, Json, Map}; use itertools::Itertools; +use lru_cache::LruCache; use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId}; use serde::{Deserialize, Serialize}; use url::Url; @@ -34,7 +35,7 @@ pub struct Service { services: Services, db: Data, tickets: Mutex>>, - pending_code_grants: tokio::sync::Mutex>, + pending_code_grants: tokio::sync::Mutex>, } struct Data { @@ -118,7 +119,9 @@ impl crate::Service for Service { refreshtoken_refreshtokeninfo: args.db["refreshtoken_refreshtokeninfo"].clone(), }, tickets: Mutex::default(), - pending_code_grants: tokio::sync::Mutex::default(), + pending_code_grants: tokio::sync::Mutex::new(LruCache::new( + Self::MAX_PENDING_CODE_GRANTS, + )), })) } @@ -127,6 +130,10 @@ impl crate::Service for Service { impl Service { const ACCESS_TOKEN_MAX_AGE: Duration = Duration::from_hours(1); + // Maximum number of pending code grants which will be held in memory at once, + // to prevent unbounded memory use if someone decides to repeatedly reload the + // grant page. + const MAX_PENDING_CODE_GRANTS: usize = 100; const RANDOM_TOKEN_LENGTH: usize = 32; fn generate_token() -> String { utils::random_string(Self::RANDOM_TOKEN_LENGTH) }