nune/gitea
nune/gitea
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix OIDC introspection authentication (#31632)

Browse source 
See discussion on #31561 for some background.

The introspect endpoint was using the OIDC token itself for
authentication. This fixes it to use basic authentication with the
client ID and secret instead:

* Applications with a valid client ID and secret should be able to
  successfully introspect an invalid token, receiving a 200 response
  with JSON data that indicates the token is invalid
* Requests with an invalid client ID and secret should not be able
  to introspect, even if the token itself is valid

Unlike #31561 (which just future-proofed the current behavior against
future changes to `DISABLE_QUERY_AUTH_TOKEN`), this is a potential
compatibility break (some introspection requests without valid client
IDs that would previously succeed will now fail). Affected deployments
must begin sending a valid HTTP basic authentication header with their
introspection requests, with the username set to a valid client ID and
the password set to the corresponding client secret.
This commit is contained in:
Shivaram Lingamneni 2024-07-23 14:43:03 +02:00 • committed by GitHub
parent 24f9390f34
commit 2f1cb1d289
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 90 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/base/tool.go
View file

@ -48,13 +48,10 @@ func BasicAuthDecode(encoded string) (string, string, error) {
return "", "", err
}
auth := strings.SplitN(string(s), ":", 2)
if len(auth) != 2 {
return "", "", errors.New("invalid basic authentication")
if username, password, ok := strings.Cut(string(s), ":"); ok {
return username, password, nil
}
return auth[0], auth[1], nil
return "", "", errors.New("invalid basic authentication")
}
// VerifyTimeLimitCode verify time limit code