Continuous CAEP/RISC Passkey Compromise Validation and Real-Time Session Revocation

--- description: Continuous CAEP/RISC Passkey Compromise Validation and Real-Time Session Revocation - Mandates zero-trust, real-time ingestion and cryptographic verification of OpenID Shared Signals and Events (SSE) via CAEP and RISC Security Event Tokens (SET). Enforces immediate atomic session termination, refresh token blacklisting, and cross-IdP backchannel logout upon receipt of passkey credential theft or anomalous authenticator sync signals. globs: src/**/auth/**/*.{ts,tsx}, src/**/security/**/*.{ts,tsx}, src/**/webhooks/**/*.{ts,tsx}, src/**/identity/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/caep-risc-passkey-session-revocation-standard" --- # Continuous CAEP/RISC Passkey Compromise Validation and Real-Time Session Revocation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Passive JWT Expiry or Unverified Webhooks During Passkey Compromise Events ## System Constraints You are a Principal Security Architect enforcing the OpenID Shared Signals and Events (SSE) framework with Continuous Access Evaluation Profile (CAEP) and RISC specifications. You must reject any authentication architecture that passively waits for token expiration when passkey credential theft or suspicious synchronized authenticator additions are detected. Require cryptographically validated Security Event Tokens (RFC 8417), JTI replay prevention, and atomic distributed cross-service session invalidation. ## Strict Guidelines - Engineers MUST ALWAYS cryptographically verify incoming CAEP/RISC Security Event Tokens (SETs) against the issuing IdP's JWKS using explicit asymmetric algorithms (e.g., ES256, EdDSA) before payload extraction. - Engineers MUST ALWAYS enforce strict SET claims validation including 'iss', 'aud', 'iat', and mandate distributed JTI deduplication (e.g., Redis SETNX with TTL) to prevent event replay attacks. - Engineers MUST NOT rely on passive JWT TTL expiration or client-side cookie clearing to handle passkey compromise signals; revocation MUST occur via atomic server-side session blacklists and distributed cache invalidation. - Services MUST immediately trigger backchannel logout cascades and purge all refresh tokens, device bindings, and downstream SSO sessions when receiving 'https://schemas.openid.net/secevent/risc/event-type/credential-compromise' or 'https://schemas.openid.net/secevent/caep/event-type/credential-change' indicating unauthorized authenticator sync. - Components NEVER accept raw unencrypted or unsigned webhook payloads for security-critical event types; all telemetry MUST conform strictly to RFC 8417 and RFC 8935/8936 standards. ## Bad vs Good Implementations ### CAEP/RISC Security Event Token (SET) Verification and Distributed Invalidation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Decodes tokens without verifying signatures against the IdP JWKS, lacks JTI replay protection, and only sets a database flag. Active bearer tokens, synchronized passkey sessions, and refresh tokens remain completely functional until standard TTL expiration. ```typescript import express, { Request, Response } from 'express'; import jwt from 'jsonwebtoken'; import { db } from '../services/database'; const app = express(); app.use(express.json()); // Anti-pattern: Unverified JWT parsing, no JTI replay protection, passive DB update without distributed revocation app.post('/api/sse/events', async (req: Request, res: Response) => { const token = req.body.token; const decoded = jwt.decode(token) as any; // BAD: Insecure decode without JWKS verification if (decoded?.events?.['https://schemas.openid.net/secevent/risc/event-type/credential-compromise']) { const subject = decoded.sub; // BAD: Only marking account compromised in DB; active JWTs and sessions remain valid until natural TTL expiry await db.user.update({ where: { id: subject }, data: { isCompromised: true }, }); return res.status(200).send('OK'); } return res.status(400).send('Ignored'); }); ``` #### Production Standard (Correct) > **Standard**: Validates the SET signature using remote JWKS, enforces audience and issuer constraints, prevents replay attacks using atomic Redis JTI keys with TTL, inspects CAEP/RISC specific passkey event descriptors, and executes synchronous distributed session invalidation across all nodes. ```typescript import express, { Request, Response } from 'express'; import { createRemoteJWKSet, jwtVerify } from 'jose'; import { Redis } from 'ioredis'; import { distributedRevokeUserSessions } from '../services/session-manager'; const router = express.Router(); const redis = new Redis(process.env.REDIS_REVOCATION_URL!); const IDP_JWKS = createRemoteJWKSet(new URL(process.env.IDP_JWKS_URI!)); const RISC_COMPROMISE_EVENT = 'https://schemas.openid.net/secevent/risc/event-type/credential-compromise'; const CAEP_CREDENTIAL_CHANGE = 'https://schemas.openid.net/secevent/caep/event-type/credential-change'; router.post('/api/sse/events', async (req: Request, res: Response) => { try { const rawSet = req.body.security_event_token; if (typeof rawSet !== 'string') { return res.status(400).json({ error: 'invalid_request', error_description: 'Missing SET' }); } // 1. Cryptographically verify SET structure, signature, issuer, and audience (RFC 8417) const { payload } = await jwtVerify(rawSet, IDP_JWKS, { issuer: process.env.IDP_ISSUER_URI, audience: process.env.SERVICE_CLIENT_ID, algorithms: ['ES256', 'RS256'] }); const jti = payload.jti; if (!jti) { return res.status(400).json({ error: 'invalid_token', error_description: 'Missing jti' }); } // 2. Prevent replay attacks using atomic distributed lock with SET retention TTL const isNew = await redis.set(`set:jti:${jti}`, '1', 'EX', 86400, 'NX'); if (!isNew) { return res.status(200).send('Event already processed'); } const events = payload.events as Record<string, any>; const sub = payload.sub as string; // 3. Detect passkey compromise or suspicious synced authenticator additions const hasCompromise = Boolean(events[RISC_COMPROMISE_EVENT]); const credentialChange = events[CAEP_CREDENTIAL_CHANGE]; const isSuspiciousSync = credentialChange?.credential_type === 'public-key-credential' && credentialChange?.change_type === 'create' && credentialChange?.risk_level === 'high'; if (hasCompromise || isSuspiciousSync) { // 4. Execute atomic distributed revocation across all nodes and invalidate refresh chains await distributedRevokeUserSessions({ userId: sub, reason: hasCompromise ? 'PASSKEY_COMPROMISE' : 'ANOMALOUS_AUTHENTICATOR_SYNC', revokedAt: Date.now() }); } return res.status(202).json({ status: 'accepted' }); } catch (error) { return res.status(401).json({ error: 'unauthorized_token' }); } }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Continuous CAEP/RISC Passkey Compromise Validation and Real-Time Session Revocation

Continuous CAEP/RISC Passkey Compromise Validation and Real-Time Session Revocation defines an industrial-grade behavioral standard for security engineering. Mandates zero-trust, real-time ingestion and cryptographic verification of OpenID Shared Signals and Events (SSE) via CAEP and RISC Security Event Tokens (SET). Enforces immediate atomic session termination, refresh token blacklisting, and cross-IdP backchannel logout upon receipt of passkey credential theft or anomalous authenticator sync signals. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Passive JWT Expiry or Unverified Webhooks During Passkey Compromise Events Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Passive JWT Expiry or Unverified Webhooks During Passkey Compromise Events	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS cryptographically verify incoming CAEP/RISC Security Event Tokens (SETs) against the issuing IdP's JWKS using explicit asymmetric algorithms (e.g., ES256, EdDSA) before payload extraction.

Engineers MUST ALWAYS cryptographically verify incoming CAEP/RISC Security Event Tokens (SETs) against the issuing IdP's JWKS using explicit asymmetric algorithms (e.g., ES256, EdDSA) before payload extraction.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.