drewrukin opened a new pull request, #1364: URL: https://github.com/apache/knox/pull/1364
## Summary This is a fail-closed hardening change for the Swagger UI OAuth redirect helper. For authorization-code flows, the callback treated a mismatched `state` as warning-only but still stored the returned `code`, deleted the saved `state`, and invoked the callback that starts token exchange. That made the `state` check non-authoritative for `accessCode`, `authorizationCode`, and `authorization_code` flows. ## Fix - keep the existing warning when the returned `state` does not match - ignore the returned authorization code unless the `state` matches - preserve the original saved `state` when a mismatched response is rejected - leave implicit and token-style flows unchanged - add a regression test covering mismatched code, matching code, and implicit-flow behavior ## Verification - direct behavioral replay of `oauth2-redirect.js` - `org.junit.runner.JUnitCore org.apache.knox.gateway.openapi.ui.OAuth2RedirectScriptTest` -> `OK (3 tests)` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
