[
https://issues.apache.org/jira/browse/KNOX-3516?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar resolved KNOX-3516.
---------------------------------
Resolution: Fixed
> AbstractJWTFilter rejects an untrusted token issuer with no log output,
> making 401s undiagnosable
> -------------------------------------------------------------------------------------------------
>
> Key: KNOX-3516
> URL: https://issues.apache.org/jira/browse/KNOX-3516
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h3. Description
> When a JWT is presented whose {{iss}} is neither in the
> {{jwt.expected.issuer}} provider parameter nor resolvable as a
> runtime-registered dynamic-JWKS issuer,
> {{AbstractJWTFilter.validateToken(...)}} rejects the request with HTTP 401
> and emits {*}no log message at any level{*}:
>
> {code}
> // AbstractJWTFilter.java, validateToken(..., JWT token,
> RequestAudienceValidator, boolean cookieAuth)
> if (expectedIssuers.contains(token.getIssuer())) {
> return doFullTokenValidation(...);
> }
> final Set<URI> registeredIssuerJwks =
> resolveRegisteredIssuerJwks(token.getIssuer(), request);
> if (!registeredIssuerJwks.isEmpty()) {
> return doFullTokenValidation(...);
> }
> handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED,
> null); // ~line 696: silent
> return false;
> {code}
> The silence is compounded by the {{null}} message argument. Downstream:
> * On a token-exchange request, {{KnoxIDFUtils.writeErrorResponse}} omits
> {{error_description}} when the description is {{{}null{}}}, so the client
> receives exactly {{{"error":"invalid_request"}}} (27 bytes) with no
> indication of cause.
> * On the non-exchange path, {{JWTFederationFilter.handleValidationError}}
> calls {{response.sendError(status)}} with no message.
> So the failure is invisible on both the server side and the client side.
> h3. Expected behaviour
> A rejected issuer is logged server-side with the offending issuer and a
> redacted token identifier, consistent with every other rejection path in the
> class.
> h3. Actual behaviour
> Nothing is logged. The gateway log shows only the two pre-existing DEBUG
> lines ({{{}GatewayFilter.doFilter{}}}, {{{}UrlEncodedFormRequest.<init>{}}})
> followed by a 401.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
