[jira] [Work logged] (KNOX-3435) Reject authorization codes on OAuth state mismatch

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3435?focusedWorklogId=1039432&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039432 ]

ASF GitHub Bot logged work on KNOX-3435:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 03/Sep/26 13:03
            Start Date: 03/Sep/26 13:03
    Worklog Time Spent: 10m 
      Work Description: smolnar82 commented on PR #1365:
URL: https://github.com/apache/knox/pull/1365#issuecomment-5526208811

   I'm inclined to close this PR and leave our current JS "as-is" because I think we should upgrade to a higher Swagger UI version where this is already fixed (along with other improvements, features, fixes).
   Please note that the current version of those Swagger resources are a pure-copy of what the official 5.29.0 Swagger bundles.
   
   @drewrukin - it'd be nice if you can find the appropriate version where this security fix landed in Swagger. That would be a huge help.




Issue Time Tracking
-------------------

            Worklog Id:     (was: 1039432)
    Remaining Estimate: 0h
            Time Spent: 10m

> Reject authorization codes on OAuth state mismatch
> --------------------------------------------------
>
>                 Key: KNOX-3435
>                 URL: https://issues.apache.org/jira/browse/KNOX-3435
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Homepage
>    Affects Versions: 3.0.0
>            Reporter: Andrew Rukin
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> In gateway-openapi-ui/src/main/resources/swagger/oauth2-redirect.js, an OAuth state mismatch does not stop authorization-code processing. The callback reports a warning and then continues: it deletes the saved request state, copies the returned code into the authorization object, and invokes the callback that starts token exchange.
> As a result, a code returned for a different or earlier authorization request can be processed in the current authorization flow.
> This behavior breaks the OAuth response-binding requirements:
> - RFC 6749 Section 4.1.2 (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1.2) defines the authorization-response state as the exact value received from the client.
> - RFC 6749 Section 10.12 (https://www.rfc-editor.org/rfc/rfc6749.html#section-10.12) requires the client to implement CSRF protection for its redirect URI and describes validating the response by matching its binding value to the user agent's authenticated state.
> - RFC 9700 Sections 2.1 and 4.7.1 (https://www.rfc-editor.org/rfc/rfc9700.html#section-2.1 and https://www.rfc-editor.org/rfc/rfc9700.html#section-4.7.1) require OAuth clients to prevent CSRF and, when state carries application state, to protect it against tampering and swapping.
> Continuing authorization-code processing after a state mismatch accepts a response that failed this binding check, so state no longer provides the required request-to-response correlation.
> This change terminates authorization-code processing when the returned state does not match the saved state. It reports an authorization error, closes the redirect window, and returns without deleting the saved state, changing the authorization object, invoking the callback, or starting token exchange.
> The check applies to the accessCode, authorizationCode, and authorization_code flow names. Matching authorization-code responses and implicit-flow handling retain their existing behavior.
> The patch adds regression tests for all three authorization-code flow names, matching and mismatched states, an authorization object that already contains a code, and the implicit flow. The focused test suite passes 4 tests with no failures or errors.
> Pull request: https://github.com/apache/knox/pull/1365



--
This message was sent by Atlassian Jira
(v8.20.10#820010)