[
https://issues.apache.org/jira/browse/NIFIREG-74?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bryan Bende resolved NIFIREG-74.
--------------------------------
Resolution: Fixed
> Change the REST API login endpoint to use HTTP Basic Auth
> ---------------------------------------------------------
>
> Key: NIFIREG-74
> URL: https://issues.apache.org/jira/browse/NIFIREG-74
> Project: NiFi Registry
> Issue Type: Improvement
> Reporter: Kevin Doran
> Assignee: Kevin Doran
> Fix For: 0.0.1
>
>
> Currently, the REST API endpoint for logging in using a username & password
> (with a configured identity provider) is a POST that accepts Content-Type
> application/x-www-form-urlencoded, with form parameters in the body.
> Specifically, requests should be formed as:
> {noformat}
> POST /nifi-registry-api/access/token/login HTTP/1.1
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 32
> username=nobel&password=password
> {noformat}
> However, the Jersey resource we are using for the REST API in the server will
> also respond to username and password passed in URL parameters, eg:
> {noformat}
> POST /nifi-registry-api/access/token/login?username=nobel&password=password
> HTTP/1.1
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 0
> {noformat}
> This is incorrect, but it will work (actually, the current implementation of
> the javascript client is logging in this way). As there does not appear to be
> an easy way to prevent the server from mapping url parameters to form
> parameters, a client could mistakenly send url parameters to the server and
> get a token back. The issue is that the URL is not generally considered a
> protected element of the request, even when using a secure connection, so
> libraries might log the full URL with parameters, thus leaking client
> credentials. For example:
> {noformat}
> DEBUG o.s.security.web.FilterChainProxy
> /access/token/login?username=nobel&password=password has an empty filter list
> WARN o.glassfish.jersey.servlet.WebComponent A servlet request to the URI
> https://localhost:8443/nifi-registry-api/access/token/login?username=nobel&password=password
> contains form parameters in the request body but the request body has been
> consumed by the servlet or a servlet filter accessing the request parameters.
> Only resource methods using @FormParam will work as expected. Resource
> methods consuming the request body by other means will not work as expected.
> {noformat}
> After looking into options, the best approach for now seems to be to migrate
> the login endpoint and the JS client to use HTTP Basic Auth instead of form
> encoded parameters. This will prevent a client from inadvertently sending
> form params in the URL to the server in the HTTP POST.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
