Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix DPoP when path contains special chars #1526

Merged
merged 1 commit into from
Jul 23, 2024
Merged

Fix DPoP when path contains special chars #1526

merged 1 commit into from
Jul 23, 2024

Conversation

clementdenis
Copy link
Contributor

@clementdenis clementdenis commented Jul 23, 2024 •
edited
Loading

Description

Current DPoP implementation does not work when the path to the resource contains some special characters.
This can happen when requesting resources by label, like users, roles or resource sets.

I implement a test that tests a lot of characters.
The test itself can't be merged as is, as it's requires setting some variables to connect to a tenant.
I couldn't find a way to integrate this test properly in the existing test suite.

The results of the test are:

Failed 'prefix;suffix': Unexpected 404 message: {"errorCode":"E0000007","errorSummary":"Not found: Resource not found: prefix (CustomRole)","errorLink":"E0000007","errorId":"oae37-Ad6kKRuKxJK8-zIk02g","errorCauses":[]}
Failed 'prefix\suffix': 400 error: <!doctype html><html lang="en"><head><title>HTTP Status 400 – Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 – Bad Request</h1></body></html>
Failed 'prefix/suffix': 405 error: {"errorCode":"E0000022","errorSummary":"The endpoint does not support the provided HTTP method","errorLink":"E0000022","errorId":"oaegFYOF8iPTPmAJW_lXnn1NQ","errorCauses":[]}
  • DPoP enabled with just URLDecoder.decode (current impl) => some characters raise an invalid htu claim error:
Failed 'prefix suffix': www-authenticate error: DPoP algs="RS256 RS384 RS512 ES256 ES384 ES512", authorization_uri="http://domain.oktapreview.com/oauth2/v1/authorize", realm="http://domain.oktapreview.com", scope="okta.roles.read", error="invalid_dpop_proof", error_description="'htu' claim in the DPoP proof JWT is invalid.", resource="/api/v1/iam/roles/prefix suffix"
Failed 'prefix%suffix': www-authenticate error: DPoP algs="RS256 RS384 RS512 ES256 ES384 ES512", authorization_uri="http://domain.oktapreview.com/oauth2/v1/authorize", realm="http://domain.oktapreview.com", scope="okta.roles.read", error="invalid_dpop_proof", error_description="'htu' claim in the DPoP proof JWT is invalid.", resource="/api/v1/iam/roles/prefix%suffix"
Failed 'prefix;suffix': Unexpected 404 message: {"errorCode":"E0000007","errorSummary":"Not found: Resource not found: prefix (CustomRole)","errorLink":"E0000007","errorId":"oae6voX0LPbShCEYRyW-7W7qw","errorCauses":[]}
Failed 'prefix\suffix': 400 error: <!doctype html><html lang="en"><head><title>HTTP Status 400 – Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 – Bad Request</h1></body></html>
Failed 'prefix"suffix': www-authenticate error: DPoP algs="RS256 RS384 RS512 ES256 ES384 ES512", authorization_uri="http://domain.oktapreview.com/oauth2/v1/authorize", realm="http://domain.oktapreview.com", scope="okta.roles.read", error="invalid_dpop_proof", error_description="'htu' claim in the DPoP proof JWT is invalid.", resource="/api/v1/iam/roles/prefix"suffix"
Failed 'prefix/suffix': 405 error: {"errorCode":"E0000022","errorSummary":"The endpoint does not support the provided HTTP method","errorLink":"E0000022","errorId":"oaejfhvnjo8Tmm-mIKFS_G_5A","errorCauses":[]}
Failed 'prefix#suffix': www-authenticate error: DPoP algs="RS256 RS384 RS512 ES256 ES384 ES512", authorization_uri="http://domain.oktapreview.com/oauth2/v1/authorize", realm="http://domain.oktapreview.com", scope="okta.roles.read", error="invalid_dpop_proof", error_description="'htu' claim in the DPoP proof JWT is invalid.", resource="/api/v1/iam/roles/prefix#suffix"
  • DPoP enabled with final code => back to same errors as without DPoP:
Failed 'prefix;suffix': Unexpected 404 message: {"errorCode":"E0000007","errorSummary":"Not found: Resource not found: prefix (CustomRole)","errorLink":"E0000007","errorId":"oae5yrODm6QSNaslRZx_cECBg","errorCauses":[]}
Failed 'prefix\suffix': 400 error: <!doctype html><html lang="en"><head><title>HTTP Status 400 – Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 – Bad Request</h1></body></html>
Failed 'prefix/suffix': 405 error: {"errorCode":"E0000022","errorSummary":"The endpoint does not support the provided HTTP method","errorLink":"E0000022","errorId":"oaeKGPk2lB0SwmS1mZxGNXG5Q","errorCauses":[]}

Category

  • Bugfix
  • Enhancement
  • New Feature
  • Library Upgrade
  • Configuration Change
  • Versioning Change
  • Unit or Integration Test(s)
  • Documentation

Signoff

  • I have submitted a CLA for this PR
  • Each commit message explains what the commit does
  • I have updated documentation to explain what my PR does
  • My code is covered by tests if required
  • I did not edit any automatically generated files

@clementdenis
Fix DPoP when path contains special chars
985bc7d 
- Still does not work for ;/\ chars
@arvindkrishnakumar-okta arvindkrishnakumar-okta changed the base branch from master to ak_fix_dpop_special_char_case July 23, 2024 13:40
@arvindkrishnakumar-okta arvindkrishnakumar-okta merged commit ad64e5e into okta:ak_fix_dpop_special_char_case Jul 23, 2024
@arvindkrishnakumar-okta arvindkrishnakumar-okta mentioned this pull request Jul 24, 2024
Merged
13 tasks
arvindkrishnakumar-okta added a commit that referenced this pull request Jul 24, 2024
@arvindkrishnakumar-okta @clementdenis
Fix DPoP special char case (#1528)
7a5277f 
* Fix DPoP when path contains special chars (#1526)

- Still does not work for ;/\ chars

* removed unnecessary unit test

---------

Co-authored-by: Clément Denis <clement.denis@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@arvindkrishnakumar-okta arvindkrishnakumar-okta arvindkrishnakumar-okta approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@clementdenis @arvindkrishnakumar-okta