cloudfoundry / cloudfoundry/uaa-release
Combination of the default values of `uaa.jwt.refresh.format` (jwt) and `uaa.jwt.revocable` (false) results in spec-non-compliance
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 28
- Forks
- 77
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 14
Description
Based on OAuth spec, refresh tokens need to be individually revocable.
However, when we leave uaa.jwt.refresh.format (default = jwt) and uaa.jwt.revocable (default = false) to UAA-release's defaults, UAA is not compliant with this requirement.
Though it is okay to have non-spec-compliant config options for backward compatibility reason, the default UAA-release config should be spec-compliant. One solution is to set uaa.jwt.refresh.format's default to opaque. This would require a breaking change.
steps of reproduction
revoking individual refresh token does not work
uaac curl '/oauth/token/revoke/[JWT-REFRESH-TOKEN-ID]-r' -X DELETE -k
=> 404
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing jobs/uaa/spec at the uaa.jwt.revocable and uaa.jwt.refresh.format entries, then reproduce the DELETE request to /oauth/token/revoke/[JWT-REFRESH-TOKEN-ID]-r. Determine the default combination needed for individually revocable refresh tokens, account for the noted breaking change, and verify that the default release configuration is spec-compliant rather than returning 404.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100