[jira] [Assigned] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow

["Colm O hEigeartaigh (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-9241?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh reassigned CXF-9241:
----------------------------------------

    Assignee: Colm O hEigeartaigh

> ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow
> --------------------------------------------------------------------------------------------------------
>
>                 Key: CXF-9241
>                 URL: https://issues.apache.org/jira/browse/CXF-9241
>             Project: CXF
>          Issue Type: Bug
>          Components: JAX-RS Security
>    Affects Versions: 4.2.3
>         Environment: Apache CXF 4.2.3, OAuth2 Implicit Grant configuration.
>            Reporter: Guanping Zhang
>            Assignee: Colm O hEigeartaigh
>            Priority: Minor
>             Fix For: 4.2.4
>
>
> h3. Background
> According to RFC 6749 §4.2.2 (Access Token Response for Implicit Grant): "The authorization server MUST NOT issue a refresh token." 
> h3. Problem
> The base class `AbstractImplicitGrantService.processRefreshToken` correctly suppresses the refresh token to comply with the RFC. However, the subclass `ImplicitConfidentialGrantService` (lines 38-41) overrides this method to explicitly APPEND the refresh token to the redirect URI fragment.
> This creates two compounding issues:
> 1. RFC Violation: It directly violates the MUST NOT clause of RFC 6749 §4.2.2.
> 2. Security Risk: The Implicit Flow does not involve a Token Endpoint, meaning a "Confidential Client's" secret is NEVER verified during this flow. Issuing a long-lived refresh token via URL fragment (exposed to browser history, Referer headers, and logs) without client-secret binding creates a severe token leakage and replay risk.
> h3. Suggested Fix
> Remove the override in `ImplicitConfidentialGrantService` and rely on the base class behavior (suppressing the RT), or deprecate the class entirely as it promotes an insecure and non-compliant flow pattern.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)