[jira] Resolved: (SHINDIG-1361) UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token

["Paul Lindner (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SHINDIG-1361?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Paul Lindner resolved SHINDIG-1361.
-----------------------------------

    Fix Version/s: 2.0.0-RC1
       Resolution: Fixed

done.  thanks for the reading the specs!


> UrlParameterAuthenticationHandler uses the wrong URI parameter as a security token
> ----------------------------------------------------------------------------------
>
>                 Key: SHINDIG-1361
>                 URL: https://issues.apache.org/jira/browse/SHINDIG-1361
>             Project: Shindig
>          Issue Type: Bug
>          Components: Java
>            Reporter: Henning Schmiedehausen
>             Fix For: 2.0.0-RC1
>
>
> The UrlParameterAuthenticationHandler contains the following lines:
>     // OAuth token as a param
>     if (token == null && request.isSecure()) {
>       token = request.getParameter(OAUTH2_TOKEN_PARAM);
>     }
> We are using an AuthenticationHandler that manages the shindig specific authentication token and another one that manages oauth. If no shindig token (st=...) parameter is present, the shindig specific AuthenticationHandler should not be used. That works fine, as long as the request goes through http. 
> Now, with an oauth request using https, this AuthenticationHandler suddenly kicks in and tries to decode the oauth token (which has nothing to do with our secure token) as a secure token and the AuthenticationHandler  then reports an invalid or tampered filter. 
> This might be a case of "the oauth filter should run before the shindig specific filter", but I think that these three lines should not be in the UrlParameterAuthenticationHandler, because they try to mix up two seperate things. 

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.