Introduction
GitHub Actions has become a cornerstone for developers and DevOps teams looking to automate their CI/CD workflows. With the integration of OpenID Connect (OIDC), these workflows can federate with third-party services without GitHub directly intervening. However, this feature is not without flaws, particularly concerning the security of OIDC identity tokens.
The Issue with OIDC Identity Tokens
OIDC identity tokens used in GitHub Actions enable workflows to authenticate with external services. However, the lack of audience constraints in these tokens represents a potential risk. Currently, GitHub Actions allows for dynamically requesting a token with an audience selected at runtime, which can be problematic.
A Concrete Example
Consider two workflows on GitHub Actions. The first workflow uses an OIDC token to authenticate with PyPI, while the second does the same for another service. Without audience constraints, an attacker could potentially hijack the token intended for PyPI to use it maliciously on another service.
Comparison with GitLab CI/CD
GitLab CI/CD, for instance, requires the audience to be declared statically within the pipeline definition. This means the token can only be used for the specified audience, thereby reducing the risk of hijacking. In comparison, GitHub Actions offers flexibility that, while powerful, can introduce attack vectors if not properly managed.
Why Are Audience Constraints Crucial?
Audience constraints add a critical layer of security by explicitly specifying who is allowed to accept the token. This protects against the malicious use of identity tokens and ensures that each service only receives tokens intended for it.
A Call to Action for GitHub
To enhance security, GitHub should consider introducing the ability for users to define audience constraints in their workflows. Although this might require some backend adjustments, the positive impact on security would be significant.
Conclusion
Integrating audience constraints for OIDC tokens in GitHub Actions is a necessary step to improve the security of CI/CD workflows. Developers and DevOps teams must be aware of these issues to best protect their projects.
Let's discuss your project in 15 minutes.