[jira] [Commented] (KNOX-3308) Token Exchange Flow using wrong param name

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KNOX-3308?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18081606#comment-18081606 ] 

ASF subversion and git services commented on KNOX-3308:
-------------------------------------------------------

Commit e39a318ae895c6ffdfbe089bad5b8b76286d62d5 in knox's branch refs/heads/dependabot/pip/dot-github/workflows/tests/requests-2.33.0 from Larry McCay
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=e39a318ae ]

KNOX-3308 - Token Exchange Flow using wrong param name (#1211)

> Token Exchange Flow using wrong param name
> ------------------------------------------
>
>                 Key: KNOX-3308
>                 URL: https://issues.apache.org/jira/browse/KNOX-3308
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Philip Zampino
>            Assignee: Larry McCay
>            Priority: Major
>             Fix For: 3.0.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> The Token Exchange flow param name is inconsistent with the core OAuth specification and requires both a full urn as the name and a hyphen rather than an underscrore: urn:ietf:params:oauth:grant-type:token-exchange
> JWTFederationFilter is currently coded to expect a shortname with underscore 'token_exchange'.
> In addition, UrlEncodedFormRequest wrapper has a brittle getParameter implementation that hard codes the names of params that we know indicate that the processing of the request body will be handled by us and there is not danger in consuming the response out from under another handler.
> Since this is in a generic path, I want to move the knowledge of that out to the code that is handling the request processing rather than trying to keep this list in sync with the consuming code. I'll add a ServletRequestUtils to unwrap the servlet request so that we can get to the params ourselves within those specific code blocks and otherwise the wrapper will no longer treat any param names specially. This will also require the move of ServletRequestUtils to the gateway-spi module.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)