Disallow OAuth2 request_uri by default
@@ -42,6 +42,7 @@ import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
import org.apache.cxf.rt.security.crypto.CryptoUtils;
public class JwtRequestCodeFilter extends OAuthJoseJwtConsumer implements AuthorizationRequestFilter {
+ private static final String REQUEST_URI_CONTENT_TYPE = "application/oauth-authz-req+jwt";
private static final String REQUEST_PARAM = "request";
private static final String REQUEST_URI_PARAM = "request_uri";
private boolean verifyWithClientCertificates;
@@ -55,7 +56,7 @@ public class JwtRequestCodeFilter extends OAuthJoseJwtConsumer implements Author
if (requestToken == null) {
String requestUri = params.getFirst(REQUEST_URI_PARAM);
if (isRequestUriValid(client, requestUri)) {
- requestToken = WebClient.create(requestUri).get(String.class);
+ requestToken = WebClient.create(requestUri).accept(REQUEST_URI_CONTENT_TYPE).get(String.class);
}
}
if (requestToken != null) {
@@ -101,9 +102,17 @@ public class JwtRequestCodeFilter extends OAuthJoseJwtConsumer implements Author
}
return params;
}
- private boolean isRequestUriValid(Client client, String requestUri) {
- //TODO: consider restricting to specific hosts
- return requestUri != null && requestUri.startsWith("https://");
+
+ /**
+ * This method must be overridden to support request_uri. Take care to validate the request_uri properly,
+ * as otherwise it could lead to a security problem
+ * (https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-30#section-10.4)
+ * @param client the Client object
+ * @param requestUri the request_uri parameter to validate
+ * @return whether the requestUri is permitted or not
+ */
+ protected boolean isRequestUriValid(Client client, String requestUri) {
+ return false;
}
protected JwsSignatureVerifier getInitializedSigVerifier(Client c) {
if (verifyWithClientCertificates) {
