hanicz opened a new pull request, #1354: URL: https://github.com/apache/knox/pull/1354
[KNOX-3423](https://issues.apache.org/jira/browse/KNOX-3423) - Switch to JSON error messages in Knox token validation paths ## What changes were proposed in this pull request? RFC 8693 §2.2.2 / RFC 6749 §5.2 require OAuth token-exchange errors to be a JSON body (`{"error", "error_description"}`) with `Content-Type: application/json`. `JWTFederationFilter` previously emitted plain-text/HTML (`sendError`) for every path, breaking standards-compliant clients. - Errors raised while handling a **token-exchange request** now return the RFC JSON body with `Cache-Control: no-store` / `Pragma: no-cache`. HTTP status codes are unchanged (400 for param/nbf/audience, 401 for signature/expiry/parse). - Scope is the **whole exchange path**, keyed off the existing `TOKEN_EXCHANGE_REQUEST_ATTR`: both the direct param/parse errors in `TokenExchangeHandler` **and** the shared JWT-validation errors emitted by `AbstractJWTFilter` (expired / bad-signature / wrong-audience / …). The latter is the gap a handler-only fix would miss. - The normal **bearer** auth path and the **SSO-cookie** path are untouched — still plain text. ## How was this patch tested? Unit tests, local tests ``` curl -skiv -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --data 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \ 'https://localhost:8443/gateway/knoxidf/knoxidf/api/v1/token' HTTP/1.1 400 Bad Request Content-Type: application/json;charset=utf-8 {"error":"invalid_request","error_description":"the subject_token parameter is required"} ``` ``` curl -skiv -H 'Authorization: Bearer not-a-real-jwt' \ 'https://localhost:8443/gateway/tokenconsumer/auth/api/v1/pre' Content-Type: text/html;charset=iso-8859-1 <body><h2>HTTP ERROR 401 Bad request: missing token passcode.</h2> ``` ``` curl -skiv -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --data 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=abc&subject_token_type=urn:ietf:params:oauth:token-type:saml2' \ 'https://localhost:8443/gateway/tokenconsumer/auth/api/v1/pre' HTTP/1.1 400 Bad Request Content-Type: application/json;charset=utf-8 {"error":"unsupported_token_type","error_description":"unsupported subject_token_type urn:ietf:params:oauth:token-type:saml2"} ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
