[
https://issues.apache.org/jira/browse/CAMEL-24437?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109187#comment-18109187
]
Claus Ibsen commented on CAMEL-24437:
-------------------------------------
Fixed via https://github.com/apache/camel/pull/25821 (commit 495c5ad39a0f).
Resolving to sync JIRA status with the merged fix.
_Claude Code on behalf of Claus Ibsen_
> camel-oauth - authorization code flow sends no state, nonce or PKCE parameter
> -----------------------------------------------------------------------------
>
> Key: CAMEL-24437
> URL: https://issues.apache.org/jira/browse/CAMEL-24437
> Project: Camel
> Issue Type: Improvement
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{VertxOAuth.buildCodeFlowAuthRequestUrl()}} builds the authorization request
> with only a redirect URI and scopes:
> {code:java}
> return oauth2.authorizeURL(new OAuth2AuthorizationURL()
> .setRedirectUri(params.getRedirectUri())
> .setScopes(params.getScopes()));
> {code}
> {{ServletOAuth}} does the same. No {{state}}, no {{nonce}} and no PKCE
> {{code_challenge}} is sent - {{OAuthCodeFlowParams}} has a {{state}} field
> but no processor ever sets it. Correspondingly,
> {{OAuthCodeFlowCallback.process()}} accepts whatever {{code}} parameter
> arrives, exchanges it, and binds the resulting {{UserProfile}} to the
> caller's session, with nothing tying the callback to a flow that session
> actually started.
> RFC 6749 section 10.12 and OpenID Connect Core both require the
> {{state}}/{{nonce}} binding, and RFC 7636 (PKCE) is recommended for all
> clients. Related: {{InMemorySessionStore.setSessionCookie()}} hardcodes
> {{SameSite=None; Secure}}, so the session cookie is attached to cross-site
> navigations.
> Proposal:
> * Generate a random {{state}} per flow, store it in the session, and require
> it to match on callback.
> * Generate a {{nonce}} for OIDC flows and validate it in the returned ID
> token.
> * Add PKCE ({{code_challenge}}/{{code_verifier}}, S256), which the underlying
> Vert.x and Servlet OAuth libraries already support.
> * Make the session cookie SameSite configurable, defaulting to {{Lax}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
