docs: require binding the interaction handle to the browser; fix refresh-token binding claim

[osanderson]

Summary

Two documentation fixes from an attacker-mindset review.

Consent CSRF guidance (Medium finding)

CompleteAuthorization accepts an InteractionHandle from whoever presents it. Nothing in the docs said to bind the handle to the browser that started the interaction, and the reference login UI (cmd/conformance-as/authorize.go) carries it in a hidden form field.

A real login UI built that way, which signs users in from an existing session cookie, is open to consent CSRF:

1. a malicious registered client starts its own authorization;
2. it puts its handle in a self-submitting form on its own page;
3. a signed-in victim's browser approves it, and the client receives a code for the victim's account.

This is the authorization-server side of the login CSRF fixed for the client in #397. The library can't enforce the fix because the embedder owns the login UI, so the docs now state it explicitly:

• server.InteractionHandle doc comment: the attack, and the requirement to keep the handle in an HttpOnly, Secure, SameSite cookie, read it back with ParseInteractionHandle, CSRF-protect the form, and never accept it from a form field or query parameter alone.
• GETTING_STARTED step 5: the same guidance, and the pointer to the reference code no longer recommends its handle bridge.
• cmd/conformance-as/authorize.go: marked as not a model for a production login UI, and why.

server/doc.go refresh-token binding (doc error)

It said, in two places, that a refresh token is bound to the DPoP key it was issued under and that RefreshAccessToken rejects a proof from another key. The code deliberately doesn't check that (server/refresh.go): every client is confidential, and RFC 9449 §5 binds a confidential client's refresh token to client authentication. One of the two sentences was introduced by #405.

Testing

Docs and comments only; go build ./... and go vet pass.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud