[
https://issues.apache.org/jira/browse/KNOX-3435?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111125#comment-18111125
]
Andrew Rukin commented on KNOX-3435:
------------------------------------
1) PR #1365 has been closed. The affected file is copied from Swagger UI, so
fixing it in Knox would create a local divergence.
2) I could not find a Swagger UI release containing the fix; the behavior
remains in v5.32.14 and current master. I will move the fix upstream to Swagger
UI.
3) Please close this issue. Thank you!
> Reject authorization codes on OAuth state mismatch
> --------------------------------------------------
>
> Key: KNOX-3435
> URL: https://issues.apache.org/jira/browse/KNOX-3435
> Project: Apache Knox
> Issue Type: Bug
> Components: Homepage
> Affects Versions: 3.0.0
> Reporter: Andrew Rukin
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> In gateway-openapi-ui/src/main/resources/swagger/oauth2-redirect.js, an OAuth
> state mismatch does not stop authorization-code processing. The callback
> reports a warning and then continues: it deletes the saved request state,
> copies the returned code into the authorization object, and invokes the
> callback that starts token exchange.
> As a result, a code returned for a different or earlier authorization request
> can be processed in the current authorization flow.
> This behavior breaks the OAuth response-binding requirements:
> - RFC 6749 Section 4.1.2
> (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1.2) defines the
> authorization-response state as the exact value received from the client.
> - RFC 6749 Section 10.12
> (https://www.rfc-editor.org/rfc/rfc6749.html#section-10.12) requires the
> client to implement CSRF protection for its redirect URI and describes
> validating the response by matching its binding value to the user agent's
> authenticated state.
> - RFC 9700 Sections 2.1 and 4.7.1
> (https://www.rfc-editor.org/rfc/rfc9700.html#section-2.1 and
> https://www.rfc-editor.org/rfc/rfc9700.html#section-4.7.1) require OAuth
> clients to prevent CSRF and, when state carries application state, to protect
> it against tampering and swapping.
> Continuing authorization-code processing after a state mismatch accepts a
> response that failed this binding check, so state no longer provides the
> required request-to-response correlation.
> This change terminates authorization-code processing when the returned state
> does not match the saved state. It reports an authorization error, closes the
> redirect window, and returns without deleting the saved state, changing the
> authorization object, invoking the callback, or starting token exchange.
> The check applies to the accessCode, authorizationCode, and
> authorization_code flow names. Matching authorization-code responses and
> implicit-flow handling retain their existing behavior.
> The patch adds regression tests for all three authorization-code flow names,
> matching and mismatched states, an authorization object that already contains
> a code, and the implicit flow. The focused test suite passes 4 tests with no
> failures or errors.
> Pull request: https://github.com/apache/knox/pull/1365
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
