Guanping Zhang created CXF-9241:
-----------------------------------
Summary: ImplicitConfidentialGrantService violates RFC 6749 §4.2.2
by issuing Refresh Tokens in the Implicit Flow
Key: CXF-9241
URL: https://issues.apache.org/jira/browse/CXF-9241
Project: CXF
Issue Type: Bug
Components: JAX-RS Security
Affects Versions: 4.2.3
Environment: Apache CXF 4.2.3, OAuth2 Implicit Grant configuration.
Reporter: Guanping Zhang
h3. Background
According to RFC 6749 §4.2.2 (Access Token Response for Implicit Grant): "The
authorization server MUST NOT issue a refresh token."
h3. Problem
The base class `AbstractImplicitGrantService.processRefreshToken` correctly
suppresses the refresh token to comply with the RFC. However, the subclass
`ImplicitConfidentialGrantService` (lines 38-41) overrides this method to
explicitly APPEND the refresh token to the redirect URI fragment.
This creates two compounding issues:
1. RFC Violation: It directly violates the MUST NOT clause of RFC 6749 §4.2.2.
2. Security Risk: The Implicit Flow does not involve a Token Endpoint, meaning
a "Confidential Client's" secret is NEVER verified during this flow. Issuing a
long-lived refresh token via URL fragment (exposed to browser history, Referer
headers, and logs) without client-secret binding creates a severe token leakage
and replay risk.
h3. Suggested Fix
Remove the override in `ImplicitConfidentialGrantService` and rely on the base
class behavior (suppressing the RT), or deprecate the class entirely as it
promotes an insecure and non-compliant flow pattern.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
