sadpandajoe commented on code in PR #44365:
URL: https://github.com/apache/superset/pull/44365#discussion_r4204697739
##########
superset/security/api.py:
##########
@@ -279,6 +295,207 @@ def guest_token(self) -> Response:
except ValidationError as error:
return self.response_400(message=error.messages)
+ @expose("/login-token/", methods=("POST",))
+ # Request data is deliberately excluded from the event log. A resolver may
+ # read the caller's proof of identity -- an OIDC id token, an internal
+ # service credential -- from the body or query string, and
+ # ``collect_request_payload`` would otherwise persist it verbatim into
+ # ``logs.json``, including on rejection. The one-time token's TTL bounds
+ # nothing about that upstream credential's lifetime.
+ @event_logger.log_this_with_context(
+ action=lambda self, *args, **kwargs:
f"{self.__class__.__name__}.login_token",
+ include_request_data=False,
+ )
+ @safe
+ @statsd_metrics
+ @transaction()
+ def login_token(self) -> Response:
+ """Mint a one-time login token for iframe embedding.
+ ---
+ post:
+ summary: Mint a one-time login token
+ description: >-
+ Exchanges a caller-supplied proof of identity for an opaque,
single-use
+ token that GET on this same path trades for a session cookie.
Intended
+ to be called server-to-server by a trusted parent application so
the
+ underlying credential never reaches the browser. The
+ LOGIN_TOKEN_IDENTITY_RESOLVER hook decides what counts as proof.
+ responses:
+ 200:
+ description: The minted token and its expiry
+ content:
+ application/json:
+ schema: LoginTokenResponseSchema
+ 401:
+ $ref: '#/components/responses/401'
+ 404:
+ $ref: '#/components/responses/404'
+ 500:
+ $ref: '#/components/responses/500'
+ """
+ if not login_token_utils.is_enabled():
+ # 404 rather than 403: with the feature off there is nothing here
to
+ # be forbidden from, and this keeps the surface closed by default.
+ return self.response_404()
+
+ if (userinfo := login_token_utils.resolve_identity(request)) is None:
+ return self.response_401()
+
+ token, expires_on = login_token_utils.mint(userinfo)
+ logger.info(
+ "One-time login token minted for '%s' from %s",
+ userinfo.get("username") or userinfo.get("email"),
+ request.remote_addr,
+ )
+ return self.response(
+ 200,
+ access_token=token,
+ expires_at=int(expires_on.timestamp()),
+ )
+
+ @expose("/login-token/", methods=("GET",))
+ # Request data is excluded from the event log for the same reason as on
mint:
+ # the token travels in the query string, and ``collect_request_payload``
+ # would otherwise copy it into ``logs.json``. A row written while the token
+ # is still live -- for instance by a request that fails before the burn
+ # commits -- would be a redeemable credential at rest. The action name is
+ # left as the default, so existing log queries are unaffected.
+ @event_logger.log_this_with_context(include_request_data=False)
+ @statsd_metrics
+ @safe
+ @transaction()
+ def login_with_token(self) -> Response:
+ """Consume a one-time login token and establish a session.
+ ---
+ get:
+ summary: Consume a one-time login token
+ description: >-
+ Reached by navigating an iframe to this URL. Exchanges the token
for a
+ standard session cookie and redirects to `next`, so the frame
holds an
+ ordinary Superset session with the user's own roles and row-level
+ security. The token is deleted on use.
+ parameters:
+ - in: query
+ name: token
+ required: true
+ schema:
+ type: string
+ description: The opaque token returned by POST on this path
+ - in: query
+ name: next
+ required: false
+ schema:
+ type: string
+ description: >-
+ Site-relative path to redirect to, e.g. `/dashboard/1/`. Must
begin
+ with a single `/`; absolute URLs and protocol-relative values are
+ rejected and fall back to `/`.
+ responses:
+ 302:
+ description: Session established; redirect to `next`
+ 401:
+ $ref: '#/components/responses/401'
+ 404:
+ $ref: '#/components/responses/404'
+ 500:
+ $ref: '#/components/responses/500'
+ """
+ if not login_token_utils.is_enabled():
+ return self.response_404()
+
+ token = request.args.get("token", "")
+ # A single failure mode for unknown, malformed, expired and
already-spent
+ # tokens, so the response cannot be used to probe which one it was.
+ if not token or (userinfo := login_token_utils.consume(token)) is None:
+ return self.response_401()
+
+ # Refuse to replace a different user's session. A token is a bearer
+ # credential that is not bound to a browser, so without this an
attacker
+ # who mints for their own identity and gets a signed-in victim's frame
to
+ # navigate here would silently swap the victim into the attacker's
+ # account (login CSRF). The token is already burned, so a refused one
+ # cannot be retried, and the check runs before provisioning so a
refused
+ # exchange never registers or updates the attacker's account.
+ #
+ # The comparison is between accounts, not strings: the identifier is
+ # resolved through ``find_user`` exactly as ``auth_user_oauth`` will
+ # resolve it, which is case-insensitive by default (AUTH_USERNAME_CI).
+ # Comparing the raw string would refuse a user whose resolver returns
+ # "alice" for the account "Alice" -- breaking every reload of a
+ # legitimate embed after the first, with the token already burned. An
+ # identity that matches no account yet is never the signed-in user, so
+ # it is refused as well.
+ #
+ # This only narrows the residual risk: a victim with no Superset
session,
+ # the usual case for an embed, still has nothing here to compare
against.
+ resolved_username = userinfo.get("username") or userinfo.get("email")
+ if getattr(current_user, "is_authenticated", False):
+ resolved_user =
self.appbuilder.sm.find_user(username=resolved_username)
+ current_user_id = getattr(current_user, "id", None)
+ is_same_account = (
+ resolved_user is not None and resolved_user.id ==
current_user_id
+ )
+ else:
+ is_same_account = True
+ if not is_same_account:
+ logger.warning(
+ "Refused a one-time login token for '%s': the frame already
holds "
+ "a session for a different user",
+ resolved_username,
+ )
+ return self.response_401()
+
+ # ``consume`` has already committed the burn, so nothing here can make
a
+ # spent token redeemable again. Provisioning failures are still caught
+ # and reported as a denial rather than allowed to escape: an exception
+ # would otherwise surface as a 500, which is indistinguishable from an
+ # outage to the parent application and invites a retry with a token
that
+ # no longer exists.
+ try:
+ user = self.appbuilder.sm.auth_user_oauth(userinfo)
Review Comment:
A user created on first redemption ends up with FAB's default empty-password
hash, because `auth_user_oauth` calls `add_user` without a password. With the
default `AUTH_TYPE = AUTH_DB` and `AUTH_USER_REGISTRATION = True`, `POST
/login/` with `username=<new user>&password=%00` then succeeds with no token:
the login form's `DataRequired` accepts the NUL character, and Werkzeug's
scrypt and PBKDF2 hashes of `""` and `"\x00"` are identical (HMAC zero-pads the
key), so `auth_user_db` accepts it and an anonymous visitor gets the new
account's roles.
Should provisioning here give the new user an unusable password, or should
the config docs require a non-DB `AUTH_TYPE` when `AUTH_USER_REGISTRATION` is
on?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
