Andrea Cosentino created CAMEL-24437:
----------------------------------------
Summary: camel-oauth - authorization code flow sends no state,
nonce or PKCE parameter
Key: CAMEL-24437
URL: https://issues.apache.org/jira/browse/CAMEL-24437
Project: Camel
Issue Type: Improvement
Components: camel-oauth
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
{{VertxOAuth.buildCodeFlowAuthRequestUrl()}} builds the authorization request
with only a redirect URI and scopes:
{code:java}
return oauth2.authorizeURL(new OAuth2AuthorizationURL()
.setRedirectUri(params.getRedirectUri())
.setScopes(params.getScopes()));
{code}
{{ServletOAuth}} does the same. No {{state}}, no {{nonce}} and no PKCE
{{code_challenge}} is sent - {{OAuthCodeFlowParams}} has a {{state}} field but
no processor ever sets it. Correspondingly, {{OAuthCodeFlowCallback.process()}}
accepts whatever {{code}} parameter arrives, exchanges it, and binds the
resulting {{UserProfile}} to the caller's session, with nothing tying the
callback to a flow that session actually started.
RFC 6749 section 10.12 and OpenID Connect Core both require the
{{state}}/{{nonce}} binding, and RFC 7636 (PKCE) is recommended for all
clients. Related: {{InMemorySessionStore.setSessionCookie()}} hardcodes
{{SameSite=None; Secure}}, so the session cookie is attached to cross-site
navigations.
Proposal:
* Generate a random {{state}} per flow, store it in the session, and require it
to match on callback.
* Generate a {{nonce}} for OIDC flows and validate it in the returned ID token.
* Add PKCE ({{code_challenge}}/{{code_verifier}}, S256), which the underlying
Vert.x and Servlet OAuth libraries already support.
* Make the session cookie SameSite configurable, defaulting to {{Lax}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
