Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Properly check header before extracting the bearer token #42595

Merged
merged 2 commits into from
Aug 16, 2024
Merged

Properly check header before extracting the bearer token #42595

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
51834c5
Properly check header before extracting the bearer token
gsmet Aug 16, 2024
cd12e4c
Fix ElytronOauth2ExtensionResourceTestCase
gsmet Aug 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions ...me/src/main/java/io/quarkus/elytron/security/oauth2/runtime/auth/OAuth2AuthMechanism.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@
@ApplicationScoped
public class OAuth2AuthMechanism implements HttpAuthenticationMechanism {

private static final String BEARER_PREFIX = "Bearer ";

protected static final ChallengeData CHALLENGE_DATA = new ChallengeData(
HttpResponseStatus.UNAUTHORIZED.code(),
HttpHeaderNames.WWW_AUTHENTICATE,
Expand All @@ -42,15 +44,17 @@ public class OAuth2AuthMechanism implements HttpAuthenticationMechanism {
public Uni<SecurityIdentity> authenticate(RoutingContext context,
IdentityProviderManager identityProviderManager) {
String authHeader = context.request().headers().get("Authorization");
String bearerToken = authHeader != null ? authHeader.substring(7) : null;
if (bearerToken != null) {
// Install the OAuth2 principal as the caller
return identityProviderManager
.authenticate(new TokenAuthenticationRequest(new TokenCredential(bearerToken, "bearer")));

if (authHeader == null || !authHeader.startsWith(BEARER_PREFIX)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be tests have some spaces around... It all looks fine

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test I checked is using Bearer: <token> with a colon which is AFAICS incorrect. I'll go fix it I suppose.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added an additional commit, I'm in the middle of something and can't test my tree.

// No suitable bearer token has been found in this request,
return Uni.createFrom().nullItem();
}
// No suitable header has been found in this request,
return Uni.createFrom().nullItem();

String bearerToken = authHeader.substring(BEARER_PREFIX.length());

// Install the OAuth2 principal as the caller
return identityProviderManager
.authenticate(new TokenAuthenticationRequest(new TokenCredential(bearerToken, "bearer")));
}

@Override
Expand Down
8 changes: 4 additions & 4 deletions ...h2/src/test/java/io/quarkus/it/elytron/oauth2/ElytronOauth2ExtensionResourceTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ public void authenticated() {
ensureStarted();
RestAssured.given()
.when()
.header("Authorization", "Bearer: " + BEARER_TOKEN)
.header("Authorization", "Bearer " + BEARER_TOKEN)
.get("/api/authenticated")
.then()
.statusCode(200)
Expand All @@ -78,7 +78,7 @@ public void forbidden() {
ensureStarted();
RestAssured.given()
.when()
.header("Authorization", "Bearer: " + BEARER_TOKEN)
.header("Authorization", "Bearer " + BEARER_TOKEN)
.get("/api/forbidden")
.then()
.statusCode(403);
Expand All @@ -99,13 +99,13 @@ public void testGrpcAuthorization() {
ensureStarted();
RestAssured.given()
.when()
.header("Authorization", "Bearer: " + BEARER_TOKEN)
.header("Authorization", "Bearer " + BEARER_TOKEN)
.get("/api/grpc-writer")
.then()
.statusCode(500);
RestAssured.given()
.when()
.header("Authorization", "Bearer: " + BEARER_TOKEN)
.header("Authorization", "Bearer " + BEARER_TOKEN)
.get("/api/grpc-reader")
.then()
.statusCode(200)
Expand Down