Guanping Zhang created CXF-9236:
-----------------------------------
Summary: Hawk validator: nonce/replay protection silently disabled
by default (NonceVerifier never wired) — fail closed or auto-wire
Key: CXF-9236
URL: https://issues.apache.org/jira/browse/CXF-9236
Project: CXF
Issue Type: Improvement
Components: JAX-RS Security
Affects Versions: 4.2.1, 3.6.10
Environment: Apache CXF 3.5.7 / main, Java 11+, Hawk token type
enabled (opt-in).
Reporter: Guanping Zhang
h3. Problem
In AbstractHawkAccessTokenValidator, validateTimestampNonce(tokenKey, ts,
nonce) is a no-op when nonceVerifier == null, which is the default (plain
setter, no auto-construction). A grep of the entire tree shows no production
code path that instantiates NonceVerifierImpl or wires it into a Hawk validator
bean. Consequently, with the shipped default configuration, a captured Hawk
Authorization header (id/ts/nonce/mac) replays verbatim for the token's
lifetime: the MAC validates, but nothing enforces RFC 7669 §3.2 nonce
single-use or timestamp freshness.
Not at issue: the MAC comparison is constant-time (MessageDigest.isEqual) and
token-type confusion is guarded; the gap is solely the silently-disabled replay
protection.
h3. Suggested improvement
Either auto-wire a default NonceVerifierImpl in HawkAccessTokenValidator, or
fail closed (reject) when no nonce verifier is configured for the Hawk scheme,
so the validator cannot silently run with replay protection disabled.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
