(tooling-agents) branch main updated: ASVS audit: 10.4.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 2d7a3c0  ASVS audit: 10.4.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
2d7a3c0 is described below

commit 2d7a3c07c1431f8f4dc0403c8a29f8e1d539cc53
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:51:23 2026 +0200

    ASVS audit: 10.4.8.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/10.4.8.md | 91 +++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/10.4.8.md b/ASVS/reports/steve/v3/d0aa7e9/all/10.4.8.md
new file mode 100644
index 0000000..947c1ec
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/10.4.8.md
@@ -0,0 +1,91 @@
+# Security Audit Report: ASVS 10.4.8
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 10.4.8 |
+| **Files Analyzed** | 3 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that refresh tokens have an absolute expiration, including if sliding refresh token expiration is applied.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-10.4.8: Refresh Token Absolute Expiration
+
+### Findings for 10.4.8
+
+This codebase is an **election/voting application** acting as a relying party/web application, NOT an OAuth Authorization Server. It does not implement:
+- Token issuance
+- Refresh token generation or management
+- Token expiration policies
+
+The authentication is delegated to the `asfquart` library (specifically `asfquart.session` and `asfquart.auth`), which is not provided in the audit scope.
+
+**No findings detected** — This requirement does not apply to this codebase as it is not an OAuth Authorization Server.
+
+### Security Controls Inventory for 10.4.8
+
+| Control | Location | Status |
+|---------|----------|--------|
+| Refresh token expiration | Not in scope | Not applicable — application is not an OAuth Authorization Server |
+| Session management | `asfquart.session.read()` in `pages.py:68` | External library, not auditable from provided code |
+
+### Positive Patterns for 10.4.8
+
+- The application correctly delegates authentication to a dedicated authentication library (`asfquart`) rather than implementing its own token management, which is appropriate for a relying party.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Authentication Delegation Pattern**: The entire OIDC client functionality is delegated to the `asfquart` library. While this is architecturally sound (centralized security controls), it means compliance with ASVS 10.5.x requirements cannot be verified from the application code alone. The security posture depends entirely on the correctness of `asfquart`.
+
+2. **Not an OAuth Authorization Server**: This application is purely an OIDC relying party / OAuth client. Requirements 10.4.8 and 10.4.9 are not applicable to this codebase as it does not issue, manage, or revoke tokens.
+
+3. **Single Identity Provider Architecture**: The application appears to use only the ASF identity provider, which simplifies OIDC security (single issuer, single trust relationship) but the lack of visible configuration makes it impossible to verify that issuer pinning is enforced.
+
+4. **Session-Based Security Model**: After initial OIDC authentication, the application operates on server-side sessions rather than tokens. This means token replay/audience attacks are limited to the initial authentication flow (handled by `asfquart`), not to subsequent requests.
+
+5. **Evolving Authentication**: Comments like `### need general solution` on auth decorators suggest the authentication/authorization system is still under development, which increases risk of security gaps.
+
+## Cross-cutting Recommendations
+
+### Immediate
+1. **Audit `asfquart` Library**: The provided code cannot satisfy ASVS 10.5.x verification without examining the `asfquart` library. Conduct a focused audit of `asfquart.auth` and `asfquart.session` for:
+   - Nonce generation and validation (10.5.1)
+   - `sub` claim usage for user identification (10.5.2)
+   - Issuer URL validation (10.5.3)
+   - Audience claim validation (10.5.4)
+
+2. **Document Security Assumptions**: Create explicit documentation stating which OIDC security controls are expected from `asfquart` vs. implemented in the application.
+
+### Short-term
+3. **Add Integration Tests**: Write tests that verify the OIDC flow end-to-end, including:
+   - Rejection of tokens with incorrect nonce
+   - Rejection of tokens with mismatched audience
+   - Rejection of tokens from unauthorized issuers
+   - Proper mapping of `sub` claim to `uid`/`pid`
+
+4. **Configuration Visibility**: Surface the OIDC client configuration (issuer URL, client_id) in the application configuration rather than burying it in the library, making security audits more straightforward.
+
+### Long-term
+5. **Resolve Auth TODOs**: Address all `### need general solution` and `### check authz` placeholders to ensure the authorization model is complete and enforceable.
+
+6. **Consider Multi-IdP Support**: If the application may support multiple identity providers in the future, implement issuer-scoped user identification (`issuer` + `sub` as the unique key) now to prevent account confusion attacks later.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org