lmccay commented on code in PR #1373:
URL: https://github.com/apache/knox/pull/1373#discussion_r3924900021
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -1163,26 +1168,65 @@ public ResponseMap(String accessToken, String tokenId,
Map<String, Object> map,
}
}
- private List<String> parseRequestedAudiences() {
+ private List<String> parseRequestedResources() throws
RequestedAudienceValidationException {
+ // An RFC 8693 token-exchange request carries the requested
resource/audience in the form body,
+ // which the JWTProvider's TokenExchangeHandler has already parsed and
validated and stashed as a
+ // request attribute. When present, those body-supplied values take
precedence over the resource
+ // query parameter.
+ @SuppressWarnings("unchecked")
+ final List<String> fromExchange =
+ (List<String>)
request.getAttribute(CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR);
+ if (fromExchange != null) {
+ return fromExchange;
+ }
Review Comment:
Okay. Let's move forward here but I think we need to do some careful
testing. Having no way to ensure that the form body param is chosen over the
query param without using the JWTProvider may be problematic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
