[jira] [Resolved] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access

["Colm O hEigeartaigh (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-9223?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh resolved CXF-9223.
--------------------------------------
    Resolution: Fixed

> completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access
> ---------------------------------------------------------------------------------------------------------
>
>                 Key: CXF-9223
>                 URL: https://issues.apache.org/jira/browse/CXF-9223
>             Project: CXF
>          Issue Type: Bug
>          Components: JAX-RS
>    Affects Versions: 4.2.2
>            Reporter: Guanping Zhang
>            Assignee: Colm O hEigeartaigh
>            Priority: Minor
>             Fix For: 3.6.12, 4.2.3, 4.1.8
>
>
> In {{{}OAuthRequestFilter.validateAudiences(){}}}, when {{completeAudienceMatch}} is {{false}} (which is the default) and {{audienceIsEndpointAddress}} is {{{}true{}}}, the filter matches the incoming request path against the configured audience list using {{{}requestPath.startsWith(s){}}}.
>  
> This means an audience entry configured as {{/api/read}} will inadvertently authorize access to {{/api/readwrite}} or {{{}/api/readAdmin{}}}. This widens the resource-server access boundary beyond the intended audience configuration.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)