spring-projects / spring-projects/spring-security

with `spring-security-oatuh2-jose-7.1.0` a `jwt` with `loa` value `null` always returns an error

Open Beginner friendly
#19,346 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug

With spring-security-oauth2-jose-7.0.5 it is possible to have a loa with value null in a given jwt. For machine to machine communication, it makes no sense to set the loa, as no real user is present.

Implementation with spring-security-oauth2-jose-7.0.5:

	@Override
	public OAuth2TokenValidatorResult validate(Jwt token) {
		Assert.notNull(token, "token cannot be null");
		T claimValue = token.getClaim(this.claim);
		if (this.test.test(claimValue)) {
			return OAuth2TokenValidatorResult.success();
		}
		this.logger.debug(this.error.getDescription());
		return OAuth2TokenValidatorResult.failure(this.error);
	}

A loa with null value is forwarded to the configured claim validator, e.g. something like..

    @Bean
    JwtClaimValidator<String> loaClaimValidator() {
        return new JwtClaimValidator<>("loa", new Predicate<String>() {
            @Override
            public boolean test(final String loaClaimValue) {      
                return loaClaimValue == null;
            }
        });
    }

..configured within the WebSecurityConfig.

Implementation with spring-security-oauth2-jose-7.1.0:

	@Override
	public OAuth2TokenValidatorResult validate(Jwt token) {
		Assert.notNull(token, "token cannot be null");
		T claimValue = token.getClaim(this.claim);
		if (claimValue != null) {
			if (this.test.test(claimValue)) {
				return OAuth2TokenValidatorResult.success();
			}
		}
		this.logger.debug(this.error.getDescription());
		return OAuth2TokenValidatorResult.failure(this.error);
	}

A loa with value null returns always an error, the custom validator is ignored.

To Reproduce

  1. Create a jwt without a value for loa.
  2. Perform a request against an endpoint that validates the jwt.
  3. The custom provided JwtClaimValidator is NOT called.
  4. OAuth2TokenValidatorResult.failure(this.error) is returned.

Expected behavior

  1. Create a jwt without a value for loa.
  2. Perform a request against an endpoint that validates the jwt.
  3. The custom provided JwtClaimValidator is called.
  4. OAuth2TokenValidatorResult.success() validator is returned, if custom validator returns true.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at JwtClaimValidator.validate, using the issue's 7.0.5 and 7.1.0 implementations as the behavioral comparison. Add or update coverage for a JWT whose loa claim is null, verifying that the configured validator is called and can return success.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.