smolnar82 commented on code in PR #1373:
URL: https://github.com/apache/knox/pull/1373#discussion_r3921217352
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -1163,26 +1168,65 @@ public ResponseMap(String accessToken, String tokenId,
Map<String, Object> map,
}
}
- private List<String> parseRequestedAudiences() {
+ private List<String> parseRequestedResources() throws
RequestedAudienceValidationException {
+ // An RFC 8693 token-exchange request carries the requested
resource/audience in the form body,
+ // which the JWTProvider's TokenExchangeHandler has already parsed and
validated and stashed as a
+ // request attribute. When present, those body-supplied values take
precedence over the resource
+ // query parameter.
+ @SuppressWarnings("unchecked")
+ final List<String> fromExchange =
+ (List<String>)
request.getAttribute(CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR);
+ if (fromExchange != null) {
+ return fromExchange;
+ }
Review Comment:
The leak is really the _naming_, not the _mechanism_. I'll rename the
attribute to a generic `knox.token.requested.audiences` and reword the
docs/comment so TokenResource only knows "an upstream filter may have
pre-resolved the requested audiences; use them over the query param" — no RFC
8693 / exchange references. The exchange specifics stay entirely in
TokenExchangeHandler.
Pushing that shortly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
