Guanping Zhang created CXF-9242:
-----------------------------------
Summary: JwtAccessTokenValidator accepts absent `typ` header; OIDC
IdP issues id_tokens without `typ`, enabling token confusion in misconfigured RS
Key: CXF-9242
URL: https://issues.apache.org/jira/browse/CXF-9242
Project: CXF
Issue Type: Improvement
Components: JAX-RS Security
Affects Versions: 4.2.3
Environment: Apache CXF 4.2.3, OIDC IdP + JAX-RS Resource Server.
Reporter: Guanping Zhang
h3. Background
RFC 9068 §2.1 mandates that JWT access tokens MUST set the `typ` header to
`at+jwt`, and resource servers MUST verify this to prevent token-type confusion
attacks (e.g., using an id_token as an access token).
h3. Problem
In JwtAccessTokenValidator.validateTokenType (lines 85-87), the check only
rejects a present-and-conflicting `typ` value. When the `typ` header is absent
(null), the check passes silently.
Concurrently, CXF's OIDC IdP (IdTokenResponseFilter) never calls setType on the
id_tokens it issues — they ship with NO `typ` header.
Consequence: In a resource server deployed with a permissive configuration
(e.g., no explicit audience or issuer validation configured by the integrator),
a CXF-issued id_token clears the access-token type check, passes signature
verification, and is accepted as a Bearer access token. The RS treats the
id_token's `sub` claim as the authenticated user.
h3. Suggested Improvement
1. Require `typ=at+jwt` in JwtAccessTokenValidator (reject when `typ` is
absent).
2. Set `typ=id_token` on CXF-issued id_tokens to explicitly differentiate them
from access tokens.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
