oscerd opened a new pull request, #25821:
URL: https://github.com/apache/camel/pull/25821

   Fixes [CAMEL-24437](https://issues.apache.org/jira/browse/CAMEL-24437).
   
   buildCodeFlowAuthRequestUrl() sent only a redirect URI and scopes - no state 
- and
   OAuthCodeFlowCallback redeemed whatever code arrived and bound the resulting 
profile to
   the caller's session. Nothing tied the callback to a flow that session had 
started, which
   is the login CSRF that RFC 6749 section 10.12 and OpenID Connect Core 
require the state
   binding to prevent. OAuthCodeFlowParams already carried a state field; no 
processor set
   it. The hardcoded SameSite=None; Secure session cookie makes it reachable 
cross-site.
   
   OAuthCodeFlowProcessor now generates a 32-byte random state, stores it in 
the OAuth
   session, and passes it through both URL builders - VertxOAuth via
   OAuth2AuthorizationURL.setState, ServletOAuth as a state query parameter.
   OAuthCodeFlowCallback removes the stored value, so it is single use, and 
compares it with
   the callback's state using MessageDigest.isEqual. A callback with no flow in 
progress, or
   with a state that does not match, is answered with 400 and stops the route.
   
   Scope: state only. nonce needs ID-token validation to be worth sending, PKCE 
needs a
   code_verifier carried through AuthCodeCredentials and both authenticate()
   implementations, and the session cookie's SameSite is a separate change - 
all three are
   noted on the issue.
   
   Not verified end to end: OAuthCodeFlowVertxTest and OAuthCodeFlowServletTest 
are gated on
   an externally running Keycloak at https://oauth.localtest.me/kc, provisioned 
by the
   module's Helm chart, and were skipped here. They are what would confirm the 
provider
   echoes state back as a state message header.
   
   Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
   Signed-off-by: Andrea Cosentino <[email protected]>
   \n## Verification\n\n7 files changed, including 1 test file(s). Module build 
with \`-am\` is green on current main, no generated-file drift. Verified 
against the pre-fix code when the change was written.
   
   _Claude Code on behalf of oscerd_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to