drewrukin opened a new pull request, #1365:
URL: https://github.com/apache/knox/pull/1365

   Problem
   
   Swagger UI detects a state mismatch in the authorization-code callback but
   only logs a warning. It still saves the returned code, deletes the original
   state, and starts the token exchange.
   
   This can attach a response from another or older OAuth request to the current
   authorization flow, leading to login CSRF or authorization under the wrong
   account, tenant, or OAuth configuration.
   
   Fix
   
   Validate the returned state before either authorization-code callback path.
   This includes the normal path that stores a new code and the path where the
   authorization object already contains a code.
   
   On a mismatch, report an authorization error, close the redirect window, and
   return immediately. Do not update the authorization object, delete the saved
   state, invoke the callback, or start token exchange.
   
   Valid authorization-code responses continue through the existing callback.
   Implicit-flow responses keep their current behavior and still pass the state
   validation result to the caller.
   
   Result
   
   After this change, an authorization response cannot cross from one OAuth
   request into another. The original request state remains available after a
   rejected response, and downstream code never receives or exchanges a code
   that failed the state check.
   
   Tests cover all supported authorization-code flow names, matching and
   mismatched states, an existing authorization code, and the implicit flow.
   
   Verification
   
   mvn -pl gateway-openapi-ui -am -Dtest=OAuth2RedirectScriptTest 
-Dsurefire.failIfNoSpecifiedTests=false test
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to