(tooling-agents) branch main updated: ASVS audit: 10.7.1.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 8f93e2d  ASVS audit: 10.7.1.md (redacted)
8f93e2d is described below

commit 8f93e2df75964ff6655425b9cdf7659d90924988
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:01:57 2026 +0200

    ASVS audit: 10.7.1.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/10.7.1.md | 95 +++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/10.7.1.md b/ASVS/reports/steve/v3/d0aa7e9/all/10.7.1.md
new file mode 100644
index 0000000..69fe810
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/10.7.1.md
@@ -0,0 +1,95 @@
+# Security Audit Report: ASVS 10.7.1
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 10.7.1 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the authorization server ensures that the user consents to each authorization request. If the identity of the client cannot be assured, the authorization server must always explicitly prompt the user for consent.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-10.7.1: User Consent for Authorization Requests
+
+### Findings for 10.7.1
+
+No findings detected. This application is **not an OAuth authorization server**. It does not process authorization requests from third-party clients, does not issue access tokens, and does not manage OAuth scopes or permissions on behalf of users.
+
+The application is a voting system that uses role-based access control (`R.committer`, `R.pmc_member`) rather than OAuth delegated authorization. Users authenticate directly with the application through an external IdP session, and the application makes authorization decisions based on the authenticated identity.
+
+This requirement is **not applicable** to the audited codebase.
+
+### Security Controls Inventory for 10.7.1
+
+No applicable controls in this scope. The application does not implement authorization server functionality.
+
+### Positive Patterns for 10.7.1
+
+- The application uses well-defined role requirements (`R.committer`, `R.pmc_member`) applied through decorators, ensuring access decisions are explicit per-endpoint.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Application Role**: This is an OIDC Relying Party (client/consumer) — not an OpenID Provider or OAuth Authorization Server. Requirements 10.6.1, 10.6.2, 10.7.1, 10.7.2, and 10.7.3 are not applicable to this codebase. Only ASVS 10.5.5 (back-channel logout for relying parties) is relevant.
+
+2. **Authentication Architecture**: The application delegates all authentication to an external identity provider (ASF's OIDC system) via the `asfquart` framework. Sessions are read using `asfquart.session.read()` and authorization is enforced via `asfquart.auth.require()` decorators. The external IdP handles:
+   - User authentication
+   - Token issuance
+   - Identity assertions
+
+3. **Session Management Gap**: While authentication is properly externalized, there is no visible mechanism for the external IdP to communicate session termination back to this application. This is the primary security gap relevant to ASVS 10.5.5.
+
+4. **Missing Logout Functionality**: The application has no logout endpoint at all — neither:
+   - RP-initiated logout (user clicking "logout" to terminate their session)
+   - Back-channel logout handling (IdP-initiated session revocation)
+   
+   This means once a session is established, there appears to be no way to terminate it other than session expiration (if configured in the framework).
+
+5. **Authorization Gaps (Orthogonal Concern)**: While not directly OIDC-related, the numerous `### check authz` placeholder comments indicate that fine-grained authorization (e.g., ensuring only election owners can manage elections) is not yet implemented. Any committer can potentially manage any election.
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical)
+
+1. **Implement OIDC Back-Channel Logout Endpoint** — Add a `/backchannel-logout` endpoint that:
+   - Validates `typ: logout+jwt` in the JWT header
+   - Verifies the `events` claim contains `http://schemas.openid.net/event/backchannel-logout`
+   - Rejects tokens containing a `nonce` claim
+   - Enforces a maximum 2-minute token lifetime (exp - iat ≤ 120s)
+   - Invalidates all sessions for the identified subject (`sub`) or session (`sid`)
+
+2. **Implement Session Revocation Infrastructure** — Add a session store or blacklist mechanism that supports remote invalidation. The current `asfquart.session` usage does not appear to support this.
+
+### Short-term (High)
+
+3. **Implement RP-Initiated Logout** — Add a user-facing logout endpoint that:
+   - Destroys the local session
+   - Optionally redirects to the IdP's `end_session_endpoint` with `id_token_hint`
+   - Prevents the application from being left with orphaned sessions
+
+4. **Register Back-Channel Logout URI with IdP** — Ensure the back-channel logout URI is registered in the OIDC client configuration at the ASF identity provider.
+
+### Long-term (Maintenance)
+
+5. **Session Timeout Configuration** — Implement explicit session timeout aligned with IdP token lifetimes to limit exposure window even without back-channel logout.
+
+6. **Monitor for Logout Token Replay** — Implement a `jti`-based replay detection cache for logout tokens to prevent replay attacks on the back-channel logout endpoint.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org