(tooling-agents) branch main updated: ASVS audit: 10.6.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new b64f45c  ASVS audit: 10.6.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
b64f45c is described below

commit b64f45c06cb4c931b1e230ab4b502860062c6d51
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:51:35 2026 +0200

    ASVS audit: 10.6.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/10.6.1.md | 103 ++++++++++++++++++++++++++++
 1 file changed, 103 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/10.6.1.md b/ASVS/reports/steve/v3/d0aa7e9/all/10.6.1.md
new file mode 100644
index 0000000..fca903d
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/10.6.1.md
@@ -0,0 +1,103 @@
+# Security Audit Report: ASVS 10.6.1
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 10.6.1 |
+| **Files Analyzed** | 8 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the OpenID Provider only allows values 'code', 'ciba', 'id_token', or 'id_token code' for response mode. Note that 'code' is preferred over 'id_token code' (the OIDC Hybrid flow), and 'token' (any Implicit flow) must not be used.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-10.6.1: OpenID Provider Response Modes
+
+### Findings for 10.6.1
+
+No findings detected. This application is **not an OpenID Provider**. It acts as an OIDC Relying Party (client), consuming authentication from an external identity provider (ASF's OIDC infrastructure). The code contains no OAuth authorization server or OIDC provider functionality — there are no authorization endpoints, no token issuance endpoints, and no response_type parameter handling.
+
+**Evidence of RP-only role:**
+```python
+# pages.py - Application consumes sessions from external IdP
+import asfquart.session
+from asfquart.auth import Requirements as R
+
+# Authentication is delegated to external provider
+@asfquart.auth.require({R.committer})
+```
+
+This requirement is **not applicable** to the audited codebase.
+
+### Security Controls Inventory for 10.6.1
+
+No applicable controls in this scope. The application does not implement OpenID Provider functionality.
+
+### Positive Patterns for 10.6.1
+
+- The application correctly delegates authentication to an external identity provider rather than implementing its own OIDC provider, reducing attack surface.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Application Role**: This is an OIDC Relying Party (client/consumer) — not an OpenID Provider or OAuth Authorization Server. Requirements 10.6.1, 10.6.2, 10.7.1, 10.7.2, and 10.7.3 are not applicable to this codebase. Only ASVS 10.5.5 (back-channel logout for relying parties) is relevant.
+
+2. **Authentication Architecture**: The application delegates all authentication to an external identity provider (ASF's OIDC system) via the `asfquart` framework. Sessions are read using `asfquart.session.read()` and authorization is enforced via `asfquart.auth.require()` decorators. The external IdP handles:
+   - User authentication
+   - Token issuance
+   - Identity assertions
+
+3. **Session Management Gap**: While authentication is properly externalized, there is no visible mechanism for the external IdP to communicate session termination back to this application. This is the primary security gap relevant to ASVS 10.5.5.
+
+4. **Missing Logout Functionality**: The application has no logout endpoint at all — neither:
+   - RP-initiated logout (user clicking "logout" to terminate their session)
+   - Back-channel logout handling (IdP-initiated session revocation)
+   
+   This means once a session is established, there appears to be no way to terminate it other than session expiration (if configured in the framework).
+
+5. **Authorization Gaps (Orthogonal Concern)**: While not directly OIDC-related, the numerous `### check authz` placeholder comments indicate that fine-grained authorization (e.g., ensuring only election owners can manage elections) is not yet implemented. Any committer can potentially manage any election.
+
+## Cross-cutting Recommendations
+
+### Immediate (Critical)
+
+1. **Implement OIDC Back-Channel Logout Endpoint** — Add a `/backchannel-logout` endpoint that:
+   - Validates `typ: logout+jwt` in the JWT header
+   - Verifies the `events` claim contains `http://schemas.openid.net/event/backchannel-logout`
+   - Rejects tokens containing a `nonce` claim
+   - Enforces a maximum 2-minute token lifetime (exp - iat ≤ 120s)
+   - Invalidates all sessions for the identified subject (`sub`) or session (`sid`)
+
+2. **Implement Session Revocation Infrastructure** — Add a session store or blacklist mechanism that supports remote invalidation. The current `asfquart.session` usage does not appear to support this.
+
+### Short-term (High)
+
+3. **Implement RP-Initiated Logout** — Add a user-facing logout endpoint that:
+   - Destroys the local session
+   - Optionally redirects to the IdP's `end_session_endpoint` with `id_token_hint`
+   - Prevents the application from being left with orphaned sessions
+
+4. **Register Back-Channel Logout URI with IdP** — Ensure the back-channel logout URI is registered in the OIDC client configuration at the ASF identity provider.
+
+### Long-term (Maintenance)
+
+5. **Session Timeout Configuration** — Implement explicit session timeout aligned with IdP token lifetimes to limit exposure window even without back-channel logout.
+
+6. **Monitor for Logout Token Replay** — Implement a `jti`-based replay detection cache for logout tokens to prevent replay attacks on the back-channel logout endpoint.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org