Sandor Molnar created KNOX-3516:
-----------------------------------
Summary: AbstractJWTFilter rejects an untrusted token issuer with
no log output, making 401s undiagnosable
Key: KNOX-3516
URL: https://issues.apache.org/jira/browse/KNOX-3516
Project: Apache Knox
Issue Type: Improvement
Components: Server
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
h3. Description
When a JWT is presented whose {{iss}} is neither in the {{jwt.expected.issuer}}
provider parameter nor resolvable as a runtime-registered dynamic-JWKS issuer,
{{AbstractJWTFilter.validateToken(...)}} rejects the request with HTTP 401 and
emits {*}no log message at any level{*}:
{code}
// AbstractJWTFilter.java, validateToken(..., JWT token,
RequestAudienceValidator, boolean cookieAuth)
if (expectedIssuers.contains(token.getIssuer())) {
return doFullTokenValidation(...);
}
final Set<URI> registeredIssuerJwks =
resolveRegisteredIssuerJwks(token.getIssuer(), request);
if (!registeredIssuerJwks.isEmpty()) {
return doFullTokenValidation(...);
}
handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED,
null); // ~line 696: silent
return false;
{code}
The silence is compounded by the {{null}} message argument. Downstream:
* On a token-exchange request, {{KnoxIDFUtils.writeErrorResponse}} omits
{{error_description}} when the description is {{{}null{}}}, so the client
receives exactly {{{"error":"invalid_request"}}} (27 bytes) with no indication
of cause.
* On the non-exchange path, {{JWTFederationFilter.handleValidationError}}
calls {{response.sendError(status)}} with no message.
So the failure is invisible on both the server side and the client side.
h3. Expected behaviour
A rejected issuer is logged server-side with the offending issuer and a
redacted token identifier, consistent with every other rejection path in the
class.
h3. Actual behaviour
Nothing is logged. The gateway log shows only the two pre-existing DEBUG lines
({{{}GatewayFilter.doFilter{}}}, {{{}UrlEncodedFormRequest.<init>{}}}) followed
by a 401.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
