dxbjavid opened a new pull request, #3603: URL: https://github.com/apache/cxf/pull/3603
OAuthRequestFilter enforces its requiredScopes by comparing the number of token permissions whose name is in requiredScopes with requiredScopes.size(), but scope strings are never de-duplicated on the issuance path (parseScope splits on spaces, validateScopes is a containsAll, consent hands the requested list back as is, convertScopeToPermissions adds one permission per entry, and JwtAccessTokenValidator splits the scope claim back into a list). A client that only holds read can ask for scope=read read and the resulting token, with two read permissions, satisfies a filter configured with requiredScopes of read and admin, so the admin requirement is bypassed; the same count check also rejects a token that carries every required scope plus a duplicate. The check now collects the matching scope names into a set and requires it to contain every configured scope, with two regression tests driving validateRequest with signed JWT access tokens. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
