github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

added CSRF protection to approval page

pull/604/head
Justin Richer 2014-05-13 09:27:02 -04:00
parent fcfbf1080f
commit a253ebc908
3 changed files with 40 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approve.jsp
View File

@ -225,23 +225,24 @@
</div>
<div class="row">
<h3>
Do you authorize
"<c:choose>
<c:when test="${empty client.clientName}">
<c:out value="${client.clientId}" />
</c:when>
<c:otherwise>
<c:out value="${client.clientName}" />
</c:otherwise>
</c:choose>"?
</h3>
<h3>
Do you authorize
"<c:choose>
<c:when test="${empty client.clientName}">
<c:out value="${client.clientId}" />
</c:when>
<c:otherwise>
<c:out value="${client.clientName}" />
</c:otherwise>
</c:choose>"?
</h3>
<input id="user_oauth_approval" name="user_oauth_approval" value="true" type="hidden" />
<input name="authorize" value="Authorize" type="submit"
onclick="$('#user_oauth_approval').attr('value',true)" class="btn btn-success btn-large" />
&nbsp;
<input name="deny" value="Deny" type="submit" onclick="$('#user_oauth_approval').attr('value',false)"
class="btn btn-secondary btn-large" />
<input name="csrf" value="${ csrf }" type="hidden" />
<input name="authorize" value="Authorize" type="submit"
onclick="$('#user_oauth_approval').attr('value',true)" class="btn btn-success btn-large" />
&nbsp;
<input name="deny" value="Deny" type="submit" onclick="$('#user_oauth_approval').attr('value',false)"
class="btn btn-secondary btn-large" />
</div>
</form>

5
openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java
View File

@ -26,6 +26,7 @@ import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.UUID;
import org.mitre.oauth2.model.ClientDetailsEntity;
import org.mitre.oauth2.model.SystemScope;
@ -192,6 +193,10 @@ public class OAuthConfirmationController {
model.put("gras", false);
}
// inject a random value for CSRF purposes
String csrf = UUID.randomUUID().toString();
model.put("csrf", csrf);
authRequest.getExtensions().put("csrf", csrf);
return "approve";
}

26
openid-connect-server/src/main/java/org/mitre/openid/connect/token/TofuUserApprovalHandler.java
View File

@ -96,11 +96,21 @@ public class TofuUserApprovalHandler implements UserApprovalHandler {
return true;
} else {
// if not, check to see if the user has approved it
// TODO: make parameter name configurable?
boolean approved = Boolean.parseBoolean(authorizationRequest.getApprovalParameters().get("user_oauth_approval"));
return userAuthentication.isAuthenticated() && approved;
if (Boolean.parseBoolean(authorizationRequest.getApprovalParameters().get("user_oauth_approval"))) { // TODO: make parameter name configurable?
// check the value of the CSRF parameter
if (authorizationRequest.getExtensions().get("csrf") != null) {
if (authorizationRequest.getExtensions().get("csrf").equals(authorizationRequest.getApprovalParameters().get("csrf"))) {
// make sure the user is actually authenticated
return userAuthentication.isAuthenticated();
}
}
}
// if the above doesn't pass, it's not yet approved
return false;
}
}
@ -182,9 +192,9 @@ public class TofuUserApprovalHandler implements UserApprovalHandler {
ClientDetails client = clientDetailsService.loadClientByClientId(clientId);
// This must be re-parsed here because SECOAUTH forces us to call things in a strange order
boolean approved = Boolean.parseBoolean(authorizationRequest.getApprovalParameters().get("user_oauth_approval"));
if (approved) {
if (Boolean.parseBoolean(authorizationRequest.getApprovalParameters().get("user_oauth_approval"))
&& authorizationRequest.getExtensions().get("csrf") != null
&& authorizationRequest.getExtensions().get("csrf").equals(authorizationRequest.getApprovalParameters().get("csrf"))) {
authorizationRequest.setApproved(true);