-
Notifications
You must be signed in to change notification settings - Fork 22
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: Evaluate the redirect_uri at each step of the auth flow
fixes AM-722 (cherry picked from commit 315f8ed) # Conflicts: # gravitee-am-gateway/gravitee-am-gateway-handler/gravitee-am-gateway-handler-core/src/main/java/io/gravitee/am/gateway/handler/root/RootProvider.java # gravitee-am-gateway/gravitee-am-gateway-handler/gravitee-am-gateway-handler-oidc/src/test/java/io/gravitee/am/gateway/handler/oauth2/service/par/PushedAuthorizationRequestServiceTest.java
- Loading branch information
1 parent
eb7b669
commit ac6397d
Showing
11 changed files
with
235 additions
and
64 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
75 changes: 75 additions & 0 deletions
75
...avitee/am/gateway/handler/root/resources/handler/common/RedirectUriValidationHandler.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| /** | ||
| * Copyright (C) 2015 The Gravitee team (http://gravitee.io) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.gravitee.am.gateway.handler.root.resources.handler.common; | ||
|
|
||
| import io.gravitee.am.common.exception.oauth2.RedirectMismatchException; | ||
| import io.gravitee.am.common.utils.ConstantKeys; | ||
| import io.gravitee.am.gateway.handler.root.service.RedirectUriValidator; | ||
| import io.gravitee.am.model.Domain; | ||
| import io.gravitee.am.model.oidc.Client; | ||
| import io.vertx.core.Handler; | ||
| import io.vertx.reactivex.ext.web.RoutingContext; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| import static io.gravitee.am.gateway.handler.root.resources.endpoint.ParamUtils.getOAuthParameter; | ||
| import static io.gravitee.am.gateway.handler.root.resources.endpoint.ParamUtils.redirectMatches; | ||
|
|
||
| /** | ||
| * The authorization server validates the request to ensure that all parameters are valid. | ||
| * If the request is valid, the authorization server authenticates the resource owner and obtains | ||
| * an authorization decision (by asking the resource owner or by establishing approval via other means). | ||
| * | ||
| * See <a href="https://tools.ietf.org/html/rfc6749#section-4.1.1">4.1.1. Authorization Request</a> | ||
| * | ||
| * This specific handler is checking the validity of the redirect_uri | ||
| * | ||
| * @author Eric LELEU (eric.leleu at graviteesource.com) | ||
| * @author GraviteeSource Team | ||
| */ | ||
| public class RedirectUriValidationHandler implements Handler<RoutingContext> { | ||
|
|
||
| private final Domain domain; | ||
| private final RedirectUriValidator redirectUriValidator; | ||
|
|
||
| public RedirectUriValidationHandler(Domain domain) { | ||
| this.domain = domain; | ||
| this.redirectUriValidator = new RedirectUriValidator(); | ||
| } | ||
|
|
||
| @Override | ||
| public void handle(RoutingContext context) { | ||
| final Client client = context.get(ConstantKeys.CLIENT_CONTEXT_KEY); | ||
|
|
||
| // proceed redirect_uri parameter | ||
| parseRedirectUriParameter(context, client); | ||
|
|
||
| context.next(); | ||
| } | ||
|
|
||
| private void parseRedirectUriParameter(RoutingContext context, Client client) { | ||
| String requestedRedirectUri = getOAuthParameter(context, io.gravitee.am.common.oauth2.Parameters.REDIRECT_URI); | ||
| redirectUriValidator.validate(client, requestedRedirectUri, this::checkMatchingRedirectUri); | ||
| } | ||
|
|
||
| private void checkMatchingRedirectUri(String requestedRedirect, List<String> registeredClientRedirectUris) { | ||
| if (registeredClientRedirectUris | ||
| .stream() | ||
| .noneMatch(registeredClientUri -> redirectMatches(requestedRedirect, registeredClientUri, this.domain.isRedirectUriStrictMatching() || this.domain.usePlainFapiProfile()))) { | ||
| throw new RedirectMismatchException(String.format("The redirect_uri [ %s ] MUST match the registered callback URL for this application", requestedRedirect)); | ||
| } | ||
| } | ||
| } |
52 changes: 52 additions & 0 deletions
52
...-core/src/main/java/io/gravitee/am/gateway/handler/root/service/RedirectUriValidator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| /** | ||
| * Copyright (C) 2015 The Gravitee team (http://gravitee.io) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.gravitee.am.gateway.handler.root.service; | ||
|
|
||
| import io.gravitee.am.common.exception.oauth2.InvalidRequestException; | ||
| import io.gravitee.am.model.oidc.Client; | ||
|
|
||
| import java.util.List; | ||
| import java.util.function.BiConsumer; | ||
|
|
||
| /** | ||
| * @author Eric LELEU (eric.leleu at graviteesource.com) | ||
| * @author GraviteeSource Team | ||
| */ | ||
| public class RedirectUriValidator { | ||
| public void validate(Client client, String requestedRedirectUri, BiConsumer<String, List<String>> checkMethod) { | ||
| final List<String> registeredClientRedirectUris = client.getRedirectUris(); | ||
| final boolean hasRegisteredClientRedirectUris = registeredClientRedirectUris != null && !registeredClientRedirectUris.isEmpty(); | ||
| final boolean hasRequestedRedirectUri = requestedRedirectUri != null && !requestedRedirectUri.isEmpty(); | ||
|
|
||
| // if no requested redirect_uri and no registered client redirect_uris | ||
| // throw invalid request exception | ||
| if (!hasRegisteredClientRedirectUris && !hasRequestedRedirectUri) { | ||
| throw new InvalidRequestException("A redirect_uri must be supplied"); | ||
| } | ||
|
|
||
| // if no requested redirect_uri and more than one registered client redirect_uris | ||
| // throw invalid request exception | ||
| if (!hasRequestedRedirectUri && (registeredClientRedirectUris != null && registeredClientRedirectUris.size() > 1)) { | ||
| throw new InvalidRequestException("Unable to find suitable redirect_uri, a redirect_uri must be supplied"); | ||
| } | ||
|
|
||
| // if requested redirect_uri doesn't match registered client redirect_uris | ||
| // throw redirect mismatch exception | ||
| if (hasRequestedRedirectUri && hasRegisteredClientRedirectUris) { | ||
| checkMethod.accept(requestedRedirectUri, registeredClientRedirectUris); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.