(tooling-agents) branch main updated: ASVS audit: 10.5.1.md (redacted)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new b6f91a2  ASVS audit: 10.5.1.md (redacted)
b6f91a2 is described below

commit b6f91a2b98b6f65c141c502cf5bb87fcd711730e
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 14:01:45 2026 +0200

    ASVS audit: 10.5.1.md (redacted)
---
 ASVS/reports/steve/v3/d0aa7e9/all/10.5.1.md | 127 ++++++++++++++++++++++++++++
 1 file changed, 127 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/10.5.1.md b/ASVS/reports/steve/v3/d0aa7e9/all/10.5.1.md
new file mode 100644
index 0000000..fe10c4b
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/10.5.1.md
@@ -0,0 +1,127 @@
+# Security Audit Report: ASVS 10.5.1
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 10.5.1 |
+| **Files Analyzed** | 3 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that the client (as the relying party) mitigates ID Token replay attacks. For example, by ensuring that the 'nonce' claim in the ID Token matches the 'nonce' value sent in the authentication request to the OpenID Provider (in OAuth2 refereed to as the authorization request sent to the…
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 1 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-10.5.1: ID Token Replay Attack Mitigation (Nonce Validation)
+
+### Findings for 10.5.1
+
+### [MEDIUM]
+
+**Finding ID:** ASVS-1051-MED-001
+
+**Title:** No visible nonce generation or validation in OIDC authentication flow
+
+**File:** `v3/server/pages.py` (entire authentication flow)
+
+**Vulnerable Pattern:**
+
+The application delegates all OIDC authentication to `asfquart.auth` and `asfquart.session`, but there is no evidence in the provided code of:
+1. Nonce generation before redirecting to the OpenID Provider
+2. Nonce validation when processing the ID Token response
+3. Any state parameter handling for the authorization request
+
+```python
+# pages.py:68-80 - Session is read but no nonce validation visible
+async def basic_info():
+    """Return base-level EZT template data."""
+    basic = edict()
+    # ...
+    s = await asfquart.session.read()
+    if s:
+        basic.update(
+            uid=s['uid'],
+            name=s['fullname'],
+            email=s['email'],
+        )
+```
+
+**Data Flow:** User authentication → `asfquart.auth.require` decorator → session established → `asfquart.session.read()` returns user data. The intermediate OIDC token validation (including nonce) is not visible.
+
+**Impact:** If the `asfquart` library does not properly validate the `nonce` claim in the ID Token against the `nonce` sent in the authentication request, an attacker could replay a stolen ID Token to impersonate a user.
+
+**Note:** This finding is of MEDIUM severity because the control may exist in the `asfquart` library but cannot be verified from the provided code. The lack of visibility into the authentication flow creates an audit gap.
+
+**Remediation:** Verify that the `asfquart` library:
+1. Generates a cryptographically random `nonce` and includes it in the authentication request
+2. Stores the `nonce` in the server-side session before redirect
+3. Validates that the `nonce` claim in the received ID Token matches the stored value
+4. Rejects tokens where the nonce does not match
+
+### Security Controls Inventory for 10.5.1
+
+| Control | Location | Status |
+|---------|----------|--------|
+| Nonce generation | Not visible in provided code | **Audit gap** — delegated to `asfquart` |
+| Nonce validation on ID Token | Not visible in provided code | **Audit gap** — delegated to `asfquart` |
+| Authentication decorators | `pages.py` (multiple endpoints) | Present but delegates to external library |
+| Session reading | `pages.py:68` `asfquart.session.read()` | Reads established session; no token validation visible |
+
+### Positive Patterns for 10.5.1
+
+- Authentication is centralized through decorators (`@asfquart.auth.require`) rather than ad-hoc, reducing the risk of inconsistent nonce handling across endpoints.
+- Session data is read from a server-side store, not from client-side tokens directly.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Authentication Delegation Pattern**: The entire OIDC client functionality is delegated to the `asfquart` library. While this is architecturally sound (centralized security controls), it means compliance with ASVS 10.5.x requirements cannot be verified from the application code alone. The security posture depends entirely on the correctness of `asfquart`.
+
+2. **Not an OAuth Authorization Server**: This application is purely an OIDC relying party / OAuth client. Requirements 10.4.8 and 10.4.9 are not applicable to this codebase as it does not issue, manage, or revoke tokens.
+
+3. **Single Identity Provider Architecture**: The application appears to use only the ASF identity provider, which simplifies OIDC security (single issuer, single trust relationship) but the lack of visible configuration makes it impossible to verify that issuer pinning is enforced.
+
+4. **Session-Based Security Model**: After initial OIDC authentication, the application operates on server-side sessions rather than tokens. This means token replay/audience attacks are limited to the initial authentication flow (handled by `asfquart`), not to subsequent requests.
+
+5. **Evolving Authentication**: Comments like `### need general solution` on auth decorators suggest the authentication/authorization system is still under development, which increases risk of security gaps.
+
+## Cross-cutting Recommendations
+
+### Immediate
+1. **Audit `asfquart` Library**: The provided code cannot satisfy ASVS 10.5.x verification without examining the `asfquart` library. Conduct a focused audit of `asfquart.auth` and `asfquart.session` for:
+   - Nonce generation and validation (10.5.1)
+   - `sub` claim usage for user identification (10.5.2)
+   - Issuer URL validation (10.5.3)
+   - Audience claim validation (10.5.4)
+
+2. **Document Security Assumptions**: Create explicit documentation stating which OIDC security controls are expected from `asfquart` vs. implemented in the application.
+
+### Short-term
+3. **Add Integration Tests**: Write tests that verify the OIDC flow end-to-end, including:
+   - Rejection of tokens with incorrect nonce
+   - Rejection of tokens with mismatched audience
+   - Rejection of tokens from unauthorized issuers
+   - Proper mapping of `sub` claim to `uid`/`pid`
+
+4. **Configuration Visibility**: Surface the OIDC client configuration (issuer URL, client_id) in the application configuration rather than burying it in the library, making security audits more straightforward.
+
+### Long-term
+5. **Resolve Auth TODOs**: Address all `### need general solution` and `### check authz` placeholders to ensure the authorization model is complete and enforceable.
+
+6. **Consider Multi-IdP Support**: If the application may support multiple identity providers in the future, implement issuer-scoped user identification (`issuer` + `sub` as the unique key) now to prevent account confusion attacks later.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org