Zero-Trust OAuth 2.1 & SSRF Defense

1. Dynamic Client Onboarding

In decentralized AI ecosystems, statically hardcoded API keys are brittle. This template implements:

• RFC 9728: Protected Resource Metadata advertising authentication endpoints.
• RFC 8414: OAuth 2.0 Authorization Server Metadata.
• RFC 7591: Dynamic Client Registration (DCR) for public clients like Gemini Spark.
• RFC 7636: PKCE S256 code challenge and verifier exchange.

2. SSRF-Safe Dialer

When resolving remote Client ID Metadata Documents (CIMD), an attacker could supply an internal URL (e.g. http://169.254.169.254 or http://10.0.0.1) to trigger internal port scans.

The template prevents this using SafeHTTPClient():

func SafeHTTPClient() *http.Client {
    return &http.Client{
        Transport: &http.Transport{
            DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
                host, port, _ := net.SplitHostPort(addr)
                ips, _ := net.DefaultResolver.LookupIP(ctx, "ip", host)
                for _, ip := range ips {
                    if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() {
                        return nil, fmt.Errorf("SSRF defense blocked connection to private IP: %s", ip)
                    }
                }
                dialer := net.Dialer{Timeout: 3 * time.Second}
                return dialer.DialContext(ctx, network, net.JoinHostPort(ips[0].String(), port))
            },
        },
    }
}

3. Stateless JWT Ingress Gating

During active tool execution, the server validates HMAC-SHA256 signatures in memory without database calls, maintaining sub-millisecond response times.