Andrew Rukin created KNOX-3435:
----------------------------------
Summary: Reject authorization codes on OAuth state mismatch
Key: KNOX-3435
URL: https://issues.apache.org/jira/browse/KNOX-3435
Project: Apache Knox
Issue Type: Bug
Components: Homepage
Affects Versions: 3.0.0
Reporter: Andrew Rukin
Assignee: Sandor Molnar
Fix For: 3.1.0
In gateway-openapi-ui/src/main/resources/swagger/oauth2-redirect.js, an OAuth
state mismatch does not stop authorization-code processing. The callback
reports a warning and then continues: it deletes the saved request state,
copies the returned code into the authorization object, and invokes the
callback that starts token exchange.
As a result, a code returned for a different or earlier authorization request
can be processed in the current authorization flow.
This behavior breaks the OAuth response-binding requirements:
- RFC 6749 Section 4.1.2
(https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1.2) defines the
authorization-response state as the exact value received from the client.
- RFC 6749 Section 10.12
(https://www.rfc-editor.org/rfc/rfc6749.html#section-10.12) requires the client
to implement CSRF protection for its redirect URI and describes validating the
response by matching its binding value to the user agent's authenticated state.
- RFC 9700 Sections 2.1 and 4.7.1
(https://www.rfc-editor.org/rfc/rfc9700.html#section-2.1 and
https://www.rfc-editor.org/rfc/rfc9700.html#section-4.7.1) require OAuth
clients to prevent CSRF and, when state carries application state, to protect
it against tampering and swapping.
Continuing authorization-code processing after a state mismatch accepts a
response that failed this binding check, so state no longer provides the
required request-to-response correlation.
This change terminates authorization-code processing when the returned state
does not match the saved state. It reports an authorization error, closes the
redirect window, and returns without deleting the saved state, changing the
authorization object, invoking the callback, or starting token exchange.
The check applies to the accessCode, authorizationCode, and authorization_code
flow names. Matching authorization-code responses and implicit-flow handling
retain their existing behavior.
The patch adds regression tests for all three authorization-code flow names,
matching and mismatched states, an authorization object that already contains a
code, and the implicit flow. The focused test suite passes 4 tests with no
failures or errors.
Pull request: https://github.com/apache/knox/pull/1365
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
