You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shindig.apache.org by "Henning Schmiedehausen (JIRA)" <ji...@apache.org> on 2010/06/09 01:21:11 UTC
[jira] Created: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
----------------------------------------------------------------------------------
Key: SHINDIG-1361
URL: https://issues.apache.org/jira/browse/SHINDIG-1361
Project: Shindig
Issue Type: Bug
Components: Java
Reporter: Henning Schmiedehausen
The UrlParameterAuthenticationHandler contains the following lines:
// OAuth token as a param
if (token == null && request.isSecure()) {
token = request.getParameter(OAUTH2_TOKEN_PARAM);
}
We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12876868#action_12876868 ]
Paul Lindner commented on SHINDIG-1361:
---------------------------------------
indeed, you're correct. oauth_token values from oauth 1.0a requests will get intercepted here and will cause failures.
curses! they should have made it oauth2_token.....
I can fix this quite quickly by checking for the oauth_version parameter. If that's there then we know it's definitely not OAuth 2.0...
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Henning Schmiedehausen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12877261#action_12877261 ]
Henning Schmiedehausen commented on SHINDIG-1361:
-------------------------------------------------
reading through the specs, it seems that oauth_signature_method seems to be the right thing to use because it is required and its presence identifies this as an oauth 1.0 request. Everything else is optional in one context or another.
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12876872#action_12876872 ]
Paul Lindner commented on SHINDIG-1361:
---------------------------------------
but separating ouath2 tokens from security tokens may be the better way to do this. The way I see it is that OAuth2 and the security token are equivalent so you should try to set them in a single module.
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12877083#action_12877083 ]
Paul Lindner commented on SHINDIG-1361:
---------------------------------------
OAuth2 is supported for API calls (where oauth2 token == security token)
Adding the OAuth2 authorization flow/ui is TBD, but is pretty easy to do. (Much easier to implement than 1.0A)
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Henning Schmiedehausen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12876903#action_12876903 ]
Henning Schmiedehausen commented on SHINDIG-1361:
-------------------------------------------------
are we actually doing oauth2 anywhere in shindig yet?
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Henning Schmiedehausen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12877192#action_12877192 ]
Henning Schmiedehausen commented on SHINDIG-1361:
-------------------------------------------------
so, if we support this, then the value of "st" should be promoted forward to be used as oauth token , not the value of "oauth_token" be used as shindig token.
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12877209#action_12877209 ]
Paul Lindner commented on SHINDIG-1361:
---------------------------------------
okay, I'll probably change this to check the signature params then...
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Lindner resolved SHINDIG-1361.
-----------------------------------
Fix Version/s: 2.0.0-RC1
Resolution: Fixed
done. thanks for the reading the specs!
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
> Fix For: 2.0.0-RC1
>
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1361) UrlParameterAuthenticationHandler
uses the wrong URI parameter as a security token
Posted by "Henning Schmiedehausen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12877194#action_12877194 ]
Henning Schmiedehausen commented on SHINDIG-1361:
-------------------------------------------------
I don't think the fix in r952870 is correct, RFC5849 states, that
oauth_version
OPTIONAL. If present, MUST be set to "1.0". Provides the
version of the authentication process as defined in this
specification.
so it not being present is perfectly legal for an oauth 1.0 request.
> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1361
> URL: https://issues.apache.org/jira/browse/SHINDIG-1361
> Project: Shindig
> Issue Type: Bug
> Components: Java
> Reporter: Henning Schmiedehausen
>
> The UrlParameterAuthenticationHandler contains the following lines:
> // OAuth token as a param
> if (token == null && request.isSecure()) {
> token = request.getParameter(OAUTH2_TOKEN_PARAM);
> }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http.
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler then reports an invalid or tampered filter.
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.