drewrukin opened a new pull request, #1365: URL: https://github.com/apache/knox/pull/1365
Problem Swagger UI detects a state mismatch in the authorization-code callback but only logs a warning. It still saves the returned code, deletes the original state, and starts the token exchange. This can attach a response from another or older OAuth request to the current authorization flow, leading to login CSRF or authorization under the wrong account, tenant, or OAuth configuration. Fix Validate the returned state before either authorization-code callback path. This includes the normal path that stores a new code and the path where the authorization object already contains a code. On a mismatch, report an authorization error, close the redirect window, and return immediately. Do not update the authorization object, delete the saved state, invoke the callback, or start token exchange. Valid authorization-code responses continue through the existing callback. Implicit-flow responses keep their current behavior and still pass the state validation result to the caller. Result After this change, an authorization response cannot cross from one OAuth request into another. The original request state remains available after a rejected response, and downstream code never receives or exchanges a code that failed the state check. Tests cover all supported authorization-code flow names, matching and mismatched states, an existing authorization code, and the implicit flow. Verification mvn -pl gateway-openapi-ui -am -Dtest=OAuth2RedirectScriptTest -Dsurefire.failIfNoSpecifiedTests=false test -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
