PPT-2536: hostile and malformed input never 5xx or leak

[camreeves]

PPT-2536 test-matrix SEC-01. Second slice of the test-suite campaign.

Why

/auth/* is internet-facing and continuously scanned. The dev nginx logs show a steady trickle of probes against /auth/authority.php, .env, .bak and friends — these ride on a real route prefix, so not_found_spec.cr's unmatched-path cases never covered them.

The bar is deliberately low and absolute: never a 5xx, never a backtrace, never a credential. A 5xx on a scanner probe is both an availability signal and an information leak.

This has to hold in development mode too: auth.cr only suppresses backtraces when SG_ENV=production, and per tasks/PPT-2536/config-parity nothing in the delivered config actually sets SG_ENV.

Coverage

• scanner suffixes observed live (.php .env .bak .json .old .txt .zip .config .aspx ~ %00 .git/config .aws/credentials)
• path traversal, double-encoded traversal, CRLF header injection
• malformed token bodies: empty, missing params, unknown grant, junk JWT, JWT-shaped junk, 8KB oversized, array params
• wrong content-type on the token endpoint
• junk authorize query strings, including javascript: redirect_uri
• garbage bearer tokens on /auth/token/info and /auth/userinfo
• the open-redirect guard — a hostile redirect_uri must never come back as a Location

Result

158 examples, 0 failures. Every case already passes — this pins existing good behaviour against regression rather than fixing a defect.

🤖 Generated with Claude Code