You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "nagaboinaramgopal (via GitHub)" <gi...@apache.org> on 2026/10/02 12:56:24 UTC

[PR] oauth2: OIDC login nonce and per-attempt CSRF state [cloudstack]

nagaboinaramgopal opened a new pull request, #14296:
URL: https://github.com/apache/cloudstack/pull/14296

   ### Description
   
   Follow-up to #14205. Hardens the generic OIDC login by binding it to the authorization request with a nonce and a per-attempt state, as raised in review.
   
   On login the UI generates a random nonce and state, stores them, and sends the nonce in the authorization request. On the callback it rejects the request when the returned state does not match the stored one, before the code is exchanged, which closes the login CSRF where state was fixed to `cloudstack`. The backend verifies the id_token nonce claim against the nonce from the request. Only the generic OIDC provider checks the nonce, and the state check only applies to the OIDC flow (the built-in providers do not set it), so the google, github and keycloak logins are unchanged. The nonce travels `verifyOAuthCodeAndGetUser` to `OAuth2AuthManager` to `UserOAuth2Authenticator` to `GenericOIDCOAuth2Provider.validateAndExtractEmail`, carried by a new `nonce` API parameter.
   
   Depends on #14205.
   
   ### Types of changes
   
   - [ ] Breaking change (fix or feature that would cause existing functionality to change)
   - [ ] New feature (non-breaking change which adds functionality)
   - [ ] Bug fix (non-breaking change which fixes an issue)
   - [x] Enhancement (improves an existing feature and functionality)
   - [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
   - [ ] Build/CI
   - [ ] Test (unit or integration test code)
   
   ### How Has This Been Tested?
   
   Unit tests in the oauth2 plugin: a matching nonce is accepted and a mismatched nonce is rejected in `GenericOIDCOAuth2ProviderTest`; the existing signature and claim tests still pass.
   
   Not yet verified end to end against a live identity provider or in a browser, which needs a real IdP. The frontend state and nonce round trip has been reviewed by hand but not run.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] oauth2: OIDC login nonce and per-attempt CSRF state [cloudstack]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #14296:
URL: https://github.com/apache/cloudstack/pull/14296#issuecomment-6064939442

   This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] oauth2: OIDC login nonce and per-attempt CSRF state [cloudstack]

Posted by "github-actions[bot] (via GitHub) via commits" <co...@cloudstack.apache.org>.
github-actions[bot] commented on PR #14296:
URL: https://github.com/apache/cloudstack/pull/14296#issuecomment-6750769439

   This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] oauth2: OIDC login nonce and per-attempt CSRF state [cloudstack]

Posted by "github-actions[bot] (via GitHub) via commits" <co...@cloudstack.apache.org>.
github-actions[bot] commented on PR #14296:
URL: https://github.com/apache/cloudstack/pull/14296#issuecomment-6863502391

   This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org