[jira] [Created] (KNOX-3516) AbstractJWTFilter rejects an untrusted token issuer with no log output, making 401s undiagnosable

["Sandor Molnar (Jira)" <ji...@apache.org>]

Sandor Molnar created KNOX-3516:
-----------------------------------

             Summary: AbstractJWTFilter rejects an untrusted token issuer with no log output, making 401s undiagnosable
                 Key: KNOX-3516
                 URL: https://issues.apache.org/jira/browse/KNOX-3516
             Project: Apache Knox
          Issue Type: Improvement
          Components: Server
    Affects Versions: 3.1.0
            Reporter: Sandor Molnar
            Assignee: Sandor Molnar
             Fix For: 3.1.0


h3. Description

When a JWT is presented whose {{iss}} is neither in the {{jwt.expected.issuer}} provider parameter nor resolvable as a runtime-registered dynamic-JWKS issuer, {{AbstractJWTFilter.validateToken(...)}} rejects the request with HTTP 401 and emits {*}no log message at any level{*}:
 
{code}
// AbstractJWTFilter.java, validateToken(..., JWT token, RequestAudienceValidator, boolean cookieAuth)
if (expectedIssuers.contains(token.getIssuer())) {
  return doFullTokenValidation(...);
}
final Set<URI> registeredIssuerJwks = resolveRegisteredIssuerJwks(token.getIssuer(), request);
if (!registeredIssuerJwks.isEmpty()) {
  return doFullTokenValidation(...);
}
handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, null);  // ~line 696: silent
return false;
{code}

The silence is compounded by the {{null}} message argument. Downstream:
 * On a token-exchange request, {{KnoxIDFUtils.writeErrorResponse}} omits {{error_description}} when the description is {{{}null{}}}, so the client receives exactly {{{"error":"invalid_request"}}} (27 bytes) with no indication of cause.

 * On the non-exchange path, {{JWTFederationFilter.handleValidationError}} calls {{response.sendError(status)}} with no message.

So the failure is invisible on both the server side and the client side.
h3. Expected behaviour

A rejected issuer is logged server-side with the offending issuer and a redacted token identifier, consistent with every other rejection path in the class.
h3. Actual behaviour

Nothing is logged. The gateway log shows only the two pre-existing DEBUG lines ({{{}GatewayFilter.doFilter{}}}, {{{}UrlEncodedFormRequest.<init>{}}}) followed by a 401.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)