spring-projects / spring-projects/spring-security
with `spring-security-oatuh2-jose-7.1.0` a `jwt` with `loa` value `null` always returns an error
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
With spring-security-oauth2-jose-7.0.5 it is possible to have a loa with value null in a given jwt. For machine to machine communication, it makes no sense to set the loa, as no real user is present.
Implementation with spring-security-oauth2-jose-7.0.5:
@Override
public OAuth2TokenValidatorResult validate(Jwt token) {
Assert.notNull(token, "token cannot be null");
T claimValue = token.getClaim(this.claim);
if (this.test.test(claimValue)) {
return OAuth2TokenValidatorResult.success();
}
this.logger.debug(this.error.getDescription());
return OAuth2TokenValidatorResult.failure(this.error);
}
A loa with null value is forwarded to the configured claim validator, e.g. something like..
@Bean
JwtClaimValidator<String> loaClaimValidator() {
return new JwtClaimValidator<>("loa", new Predicate<String>() {
@Override
public boolean test(final String loaClaimValue) {
return loaClaimValue == null;
}
});
}
..configured within the WebSecurityConfig.
Implementation with spring-security-oauth2-jose-7.1.0:
@Override
public OAuth2TokenValidatorResult validate(Jwt token) {
Assert.notNull(token, "token cannot be null");
T claimValue = token.getClaim(this.claim);
if (claimValue != null) {
if (this.test.test(claimValue)) {
return OAuth2TokenValidatorResult.success();
}
}
this.logger.debug(this.error.getDescription());
return OAuth2TokenValidatorResult.failure(this.error);
}
A loa with value null returns always an error, the custom validator is ignored.
To Reproduce
- Create a
jwtwithout a value forloa. - Perform a request against an endpoint that validates the
jwt. - The custom provided
JwtClaimValidatoris NOT called. OAuth2TokenValidatorResult.failure(this.error)is returned.
Expected behavior
- Create a
jwtwithout a value forloa. - Perform a request against an endpoint that validates the
jwt. - The custom provided
JwtClaimValidatoris called. OAuth2TokenValidatorResult.success()validator is returned, if custom validator returnstrue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at JwtClaimValidator.validate, using the issue's 7.0.5 and 7.1.0 implementations as the behavioral comparison. Add or update coverage for a JWT whose loa claim is null, verifying that the configured validator is called and can return success.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100