OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Trusting Stateless JWT Expiry and Polling IdPs Without Fast-Path Invalidation) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail

--- description: OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail - Enforces deterministic, replay-resistant processing of Continuous Access Evaluation Profile (CAEP) and Shared Signals and Events (SSE) Security Event Tokens (SET). Mandates asynchronous push/pull SET ingestion, cryptographic verification via transmitter metadata, distributed low-latency revocation broadcasts (e.g., Redis Pub/Sub / Kafka), and local in-memory token cache purging across federated microservices within sub-second SLAs. globs: src/auth/**/*.ts, src/security/**/*.ts, src/middleware/**/*.ts, src/events/caep/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/oidc-caep-realtime-revocation-engine" --- # OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting Stateless JWT Expiry and Polling IdPs Without Fast-Path Invalidation ## System Constraints You are a Principal Security Architect enforcing RFC 8417 (Security Event Token), RFC 8935/8936 (Shared Signals and Events), and OpenID CAEP 1.0 invariants. Any federated microservice consuming identity-provider signals MUST cryptographically verify inbound SETs, prevent replay attacks via deterministic deduplication, enforce transactional state revocation across distributed node caches, and avoid relying purely on JWT lifetime (exp) when handling risk-level elevation or credential invalidation. ## Strict Guidelines - Services MUST verify the cryptographic signature of inbound SETs against the issuer's JWKS resolved strictly from discovery metadata (.well-known/sse-configuration). - Receivers MUST validate standard JWT claims: 'iss' matching configured transmitter, 'aud' matching local client identity, 'iat' within accepted drift window (max 60s), and 'jti' verified against a persistent distributed cache for replay prevention. - Handlers MUST process CAEP events ('session-revoked', 'credential-change', 'assurance-level-change') by broadcasting revocation across local L1/L2 token caches within a sub-second SLA (< 500ms). - Receivers MUST return HTTP 202 Accepted immediately after synchronous signature and schema validation, delegating downstream revocation fan-out to asynchronous distributed queues. - Engineers MUST NOT rely solely on JWT 'exp' expiration or periodic poll-based validation when risk conditions or administrative revocations occur upstream. - Services MUST handle partial subject identifiers (e.g., 'iss_sub', 'email', 'opaque_id') deterministically and map all associated active sessions to avoid token leakage across identity formats. ## Bad vs Good Implementations ### CAEP Security Event Token (SET) Verification and Distributed Invalidation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Decodes JWT without signature verification against SSE discovery keys, misses replay defense (jti validation), uses non-standard HTTP 200 instead of 202, and only invalidates a local in-memory cache without fanning out to other federated instances. ```typescript import { Request, Response } from 'express'; import jwt from 'jsonwebtoken'; // ANTI-PATTERN: Insecure decoding, no replay detection, no distributed push export async function handleCaepWebhook(req: Request, res: Response) { const rawToken = req.body.token; const decoded = jwt.decode(rawToken) as any; if (decoded.events?.['https://schemas.openid.net/secevent/caep/event-type/session-revoked']) { const sub = decoded.sub; // Flaw: Synchronous in-memory only clear, vulnerability to replay, no JWKS verification globalSessionCache.delete(sub); } res.status(200).send('OK'); } ``` #### Production Standard (Correct) > **Standard**: Implements strict cryptographic verification using Jose Remote JWKS, enforces replay mitigation via atomic Redis NX locks on JTI, returns HTTP 202 per RFC specs, and asynchronously propagates revocations across federated instances via distributed pub/sub. ```typescript import { Request, Response } from 'express'; import { createRemoteJWKSet, jwtVerify } from 'jose'; import { Redis } from 'ioredis'; interface CaepEnvConfig { issuer: string; audience: string; jwksUri: string; } export class CaepReceiverService { private jwks: ReturnType<typeof createRemoteJWKSet>; constructor( private readonly config: CaepEnvConfig, private readonly redis: Redis, private readonly eventBus: (channel: string, payload: string) => Promise<void> ) { this.jwks = createRemoteJWKSet(new URL(config.jwksUri)); } public async handleWebhook(req: Request, res: Response): Promise<void> { const authHeader = req.headers['authorization']; const rawSet = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : (req.body?.set ?? req.body); if (typeof rawSet !== 'string') { res.status(400).json({ error: 'invalid_request', error_description: 'Missing SET payload' }); return; } try { const { payload } = await jwtVerify(rawSet, this.jwks, { issuer: this.config.issuer, audience: this.config.audience, clockTolerance: '60s', }); const jti = payload.jti; if (!jti) { res.status(400).json({ error: 'invalid_request', error_description: 'SET missing jti claim' }); return; } // Enforce Replay Protection: NX lock with SET TTL (e.g., 24 hours) const isNew = await this.redis.set(`caep:jti:${jti}`, '1', 'EX', 86400, 'NX'); if (!isNew) { res.status(202).send(); // Idempotent success return; } const events = payload.events as Record<string, unknown> | undefined; if (!events) { res.status(400).json({ error: 'invalid_request', error_description: 'Missing events claim' }); return; } // RFC 8935 immediate acknowledgement res.status(202).send(); // Asynchronous fan-out across federated services const sessionRevocation = events['https://schemas.openid.net/secevent/caep/event-type/session-revoked']; if (sessionRevocation) { const subject = payload.sub || (payload.subject as { sub?: string })?.sub; if (subject) { await this.eventBus('auth:revocations', JSON.stringify({ subject, revokedAt: Date.now() })); await this.redis.publish('auth:session:invalidate', subject); } } } catch (err) { res.status(401).json({ error: 'invalid_token', error_description: 'Cryptographic verification failed' }); } } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail

OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces deterministic, replay-resistant processing of Continuous Access Evaluation Profile (CAEP) and Shared Signals and Events (SSE) Security Event Tokens (SET). Mandates asynchronous push/pull SET ingestion, cryptographic verification via transmitter metadata, distributed low-latency revocation broadcasts (e.g., Redis Pub/Sub / Kafka), and local in-memory token cache purging across federated microservices within sub-second SLAs. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Stateless JWT Expiry and Polling IdPs Without Fast-Path Invalidation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Stateless JWT Expiry and Polling IdPs Without Fast-Path Invalidation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST verify the cryptographic signature of inbound SETs against the issuer's JWKS resolved strictly from discovery metadata (.well-known/sse-configuration).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.