[
https://issues.apache.org/jira/browse/CAMEL-24437?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107120#comment-18107120
]
Andrea Cosentino commented on CAMEL-24437:
------------------------------------------
Related gap in the same flow, worth fixing here rather than separately:
{{OAuthCodeFlowProcessor.getPostLoginUrl()}} reads {{X-Forwarded-Proto}},
{{X-Forwarded-Host}} and {{X-Forwarded-Port}} straight off the message and
assembles {{postLoginUrl}} from them. That value is stored in the OAuth session
and used verbatim by {{OAuthCodeFlowCallback.sendRedirect()}} once
authentication completes, with no check that the result points at the
application's own host or at the configured redirect URI's origin.
Notably the platform-http-vertx router sets {{AllowForwardHeaders.NONE}}, so
the transport deliberately does not trust these headers; the processor
reintroduces that trust at the application layer.
Proposal: validate the assembled URL against an allow-list - the configured
redirect-uri origin, or an explicit list of permitted hosts - and fall back to
a relative path or the configured base URL when it does not match. Honouring
forwarded headers at all could be an explicit opt-in, matching what the router
already decided.
_Claude Code on behalf of oscerd_
> camel-oauth - authorization code flow sends no state, nonce or PKCE parameter
> -----------------------------------------------------------------------------
>
> Key: CAMEL-24437
> URL: https://issues.apache.org/jira/browse/CAMEL-24437
> Project: Camel
> Issue Type: Improvement
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{VertxOAuth.buildCodeFlowAuthRequestUrl()}} builds the authorization request
> with only a redirect URI and scopes:
> {code:java}
> return oauth2.authorizeURL(new OAuth2AuthorizationURL()
> .setRedirectUri(params.getRedirectUri())
> .setScopes(params.getScopes()));
> {code}
> {{ServletOAuth}} does the same. No {{state}}, no {{nonce}} and no PKCE
> {{code_challenge}} is sent - {{OAuthCodeFlowParams}} has a {{state}} field
> but no processor ever sets it. Correspondingly,
> {{OAuthCodeFlowCallback.process()}} accepts whatever {{code}} parameter
> arrives, exchanges it, and binds the resulting {{UserProfile}} to the
> caller's session, with nothing tying the callback to a flow that session
> actually started.
> RFC 6749 section 10.12 and OpenID Connect Core both require the
> {{state}}/{{nonce}} binding, and RFC 7636 (PKCE) is recommended for all
> clients. Related: {{InMemorySessionStore.setSessionCookie()}} hardcodes
> {{SameSite=None; Secure}}, so the session cookie is attached to cross-site
> navigations.
> Proposal:
> * Generate a random {{state}} per flow, store it in the session, and require
> it to match on callback.
> * Generate a {{nonce}} for OIDC flows and validate it in the returned ID
> token.
> * Add PKCE ({{code_challenge}}/{{code_verifier}}, S256), which the underlying
> Vert.x and Servlet OAuth libraries already support.
> * Make the session cookie SameSite configurable, defaulting to {{Lax}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
