Reject authorization codes on OAuth state mismatch - #1365
Open
drewrukin wants to merge 1 commit into
Open
Conversation
The Swagger UI OAuth redirect callback only reported a warning when an authorization-code response returned a mismatched state. It then stored the returned code and started token exchange. Reject mismatched responses before invoking the callback, preserve the original state, and add regression coverage for every supported authorization-code flow name and the existing implicit-flow behavior.
Author
|
The two Actions workflows for the current head are waiting for maintainer approval and have not created any jobs:
Could a maintainer approve these workflows? The failed Publish Test Results run linked from the earlier PR belongs to closed PR #1364 and commit 4e3f422. Its parent workflow produced no jobs or artifacts, so the publisher failed while opening the absent Event File artifact. The current PR head is 99a19a8. |
Contributor
|
@drewrukin i just approved it. |
Test Results 3 files 3 suites 8s ⏱️ Results for commit 99a19a8. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Swagger UI detects a state mismatch in the authorization-code callback but
only logs a warning. It still saves the returned code, deletes the original
state, and starts the token exchange.
This can attach a response from another or older OAuth request to the current
authorization flow, leading to login CSRF or authorization under the wrong
account, tenant, or OAuth configuration.
Fix
Validate the returned state before either authorization-code callback path.
This includes the normal path that stores a new code and the path where the
authorization object already contains a code.
On a mismatch, report an authorization error, close the redirect window, and
return immediately. Do not update the authorization object, delete the saved
state, invoke the callback, or start token exchange.
Valid authorization-code responses continue through the existing callback.
Implicit-flow responses keep their current behavior and still pass the state
validation result to the caller.
Result
After this change, an authorization response cannot cross from one OAuth
request into another. The original request state remains available after a
rejected response, and downstream code never receives or exchanges a code
that failed the state check.
Tests cover all supported authorization-code flow names, matching and
mismatched states, an existing authorization code, and the implicit flow.
Verification
mvn -pl gateway-openapi-ui -am -Dtest=OAuth2RedirectScriptTest -Dsurefire.failIfNoSpecifiedTests=false test