[
https://issues.apache.org/jira/browse/CXF-9241?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh updated CXF-9241:
-------------------------------------
Fix Version/s: 4.1.9
> ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh
> Tokens in the Implicit Flow
> --------------------------------------------------------------------------------------------------------
>
> Key: CXF-9241
> URL: https://issues.apache.org/jira/browse/CXF-9241
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Affects Versions: 4.2.3
> Environment: Apache CXF 4.2.3, OAuth2 Implicit Grant configuration.
> Reporter: Guanping Zhang
> Assignee: Colm O hEigeartaigh
> Priority: Minor
> Fix For: 4.1.9, 4.2.4
>
>
> h3. Background
> According to RFC 6749 §4.2.2 (Access Token Response for Implicit Grant): "The
> authorization server MUST NOT issue a refresh token."
> h3. Problem
> The base class `AbstractImplicitGrantService.processRefreshToken` correctly
> suppresses the refresh token to comply with the RFC. However, the subclass
> `ImplicitConfidentialGrantService` (lines 38-41) overrides this method to
> explicitly APPEND the refresh token to the redirect URI fragment.
> This creates two compounding issues:
> 1. RFC Violation: It directly violates the MUST NOT clause of RFC 6749 §4.2.2.
> 2. Security Risk: The Implicit Flow does not involve a Token Endpoint,
> meaning a "Confidential Client's" secret is NEVER verified during this flow.
> Issuing a long-lived refresh token via URL fragment (exposed to browser
> history, Referer headers, and logs) without client-secret binding creates a
> severe token leakage and replay risk.
> h3. Suggested Fix
> Remove the override in `ImplicitConfidentialGrantService` and rely on the
> base class behavior (suppressing the RT), or deprecate the class entirely as
> it promotes an insecure and non-compliant flow pattern.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
