[jira] Created: (SHINDIG-1454) SecurityToken leak in BlobCrypterSecurityTokenCodec

["Okke Harsta (JIRA)" <ji...@apache.org>]

SecurityToken leak in BlobCrypterSecurityTokenCodec 
----------------------------------------------------

                 Key: SHINDIG-1454
                 URL: https://issues.apache.org/jira/browse/SHINDIG-1454
             Project: Shindig
          Issue Type: Bug
          Components: Java
    Affects Versions: 2.0.0
            Reporter: Okke Harsta


If shindig is secured by not allowing anonymous calls (shindig.allowUnauthenticated=false) then rest calls are not accepted when there is no security token present. However if one makes a rest call with an empty SecurityToken (http://localhost:8080/social/rest/people/john.doe?st=) then an AnonymousSecurityToken is returned (without checking if we allow this). Code in BlobCrypterSecurityTokenCodec (the SecurityTokenCodec used when running in secure mode):

public SecurityToken createToken(Map<String, String> tokenParameters)
      throws SecurityTokenException {
    String token = tokenParameters.get(SecurityTokenCodec.SECURITY_TOKEN_NAME);
    if (StringUtils.isBlank(token)) {
      // No token is present, assume anonymous access
      return new AnonymousSecurityToken();
    }

The logical thing to do is to return null. This can already be done in UrlParameterAuthenticationHandler:

public SecurityToken getSecurityTokenFromRequest(HttpServletRequest request)
      throws InvalidAuthenticationException {
    Map<String, String> parameters = getMappedParameters(request);
try {
      if (token == null || StringUtils.isBlank(token)) {
        return null;
      }

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.