omniauth-google-oauth2 1.2.2 → 1.2.3

data/lib/omniauth/strategies/google_oauth2.rb

@@ -3,6 +3,8 @@
 require 'jwt'
 require 'oauth2'
 require 'omniauth/strategies/oauth2'
+require 'openssl'
+require 'stringio'
 require 'uri'
 
 module OmniAuth
@@ -14,8 +16,76 @@ module OmniAuth
       BASE_SCOPES = %w[profile email openid].freeze
       DEFAULT_SCOPE = 'email,profile'
       USER_INFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo'
+      JWKS_URL = 'https://www.googleapis.com/oauth2/v3/certs'
+      JWKS_CACHE_TTL = 3600
+      JWKS_RETRY_INTERVAL = 60
+      LOG_MESSAGE_LIMIT = 200
+      REQUIRED_ID_TOKEN_CLAIMS = %w[iss aud exp sub].freeze
       AUTHORIZE_OPTIONS = %i[access_type hd login_hint prompt request_visible_actions scope state redirect_uri include_granted_scopes enable_granular_consent openid_realm device_id device_name]
 
+      JwksUnavailable = Class.new(StandardError)
+
+      @jwks_mutex = Mutex.new
+
+      class << self
+        # Google's signing keys rotate, so the key set is shared across requests
+        # and refetched on expiry or when a token names a kid we do not hold.
+        # The fetch deliberately happens under the lock: concurrent callers wait
+        # for one request rather than each issuing their own.
+        # The keys belong to Google, not to any one strategy class, so a subclass
+        # shares this cache rather than keeping a second one and refetching the
+        # same data. Delegating also keeps it from reaching for a mutex it does
+        # not own, which is only defined here.
+        def cached_jwks(force: false, &fetch)
+          return GoogleOauth2.cached_jwks(force: force, &fetch) unless equal?(GoogleOauth2)
+
+          @jwks_mutex.synchronize do
+            now = ::Time.now.to_i
+
+            # A forced refresh means some token named a kid we do not hold, which
+            # the sender chooses freely. Honour it no more often than the retry
+            # interval, or it becomes a way to drive unlimited fetches, each one
+            # holding this lock while every other login waits.
+            force &&= @jwks_forced_at.nil? || now >= @jwks_forced_at + JWKS_RETRY_INTERVAL
+
+            if force || @jwks.nil? || now >= @jwks_expires_at.to_i
+              # Back off even with nothing cached. Otherwise an unreachable
+              # endpoint queues every waiting caller behind its own timeout,
+              # since the lock serializes them and no expiry has been recorded.
+              raise JwksUnavailable, 'within JWKS retry backoff' if @jwks.nil? && now < @jwks_retry_at.to_i
+
+              @jwks_forced_at = now if force
+
+              begin
+                @jwks = yield
+                @jwks_expires_at = ::Time.now.to_i + JWKS_CACHE_TTL
+              rescue StandardError
+                retry_at = ::Time.now.to_i + JWKS_RETRY_INTERVAL
+                @jwks_retry_at = retry_at
+                raise if @jwks.nil?
+
+                # Google's keys outlive this cache by a wide margin, so serve the
+                # stale set through a short outage rather than failing every
+                # login, and back off instead of refetching on each request.
+                @jwks_expires_at = retry_at
+              end
+            end
+            @jwks
+          end
+        end
+
+        def reset_jwks_cache!
+          return GoogleOauth2.reset_jwks_cache! unless equal?(GoogleOauth2)
+
+          @jwks_mutex.synchronize do
+            @jwks = nil
+            @jwks_expires_at = nil
+            @jwks_retry_at = nil
+            @jwks_forced_at = nil
+          end
+        end
+      end
+
       option :name, 'google_oauth2'
       option :skip_jwt, false
       option :jwt_leeway, 60
@@ -66,21 +136,9 @@ module OmniAuth
 
       extra do
         hash = {}
-        token = nil_or_empty?(access_token['id_token']) ? access_token.token : access_token['id_token']
+        token = access_token['id_token']
         hash[:id_token] = token
-        if !options[:skip_jwt] && !nil_or_empty?(token)
-          decoded = ::JWT.decode(token, nil, false).first
-
-          # We have to manually verify the claims because the third parameter to
-          # JWT.decode is false since no verification key is provided.
-          ::JWT::Claims.verify_payload!(decoded,
-                                        iss: ALLOWED_ISSUERS,
-                                        aud: options.client_id,
-                                        exp: { leeway: options.jwt_leeway },
-                                        nbf: { leeway: options.jwt_leeway })
-
-          hash[:id_info] = decoded
-        end
+        hash[:id_info] = id_token_claims(token) if !options[:skip_jwt] && !nil_or_empty?(token)
         hash[:raw_info] = raw_info unless skip_info?
         prune! hash
       end
@@ -92,6 +150,11 @@ module OmniAuth
       def custom_build_access_token
         access_token = get_access_token(request)
 
+        # Nothing in the request produced a usable credential. Raising here gives
+        # the caller an ordinary auth failure; the alternative is omniauth-oauth2
+        # calling #expired? on nil and the request dying with a NoMethodError.
+        raise CallbackError.new(:invalid_credentials, 'No valid credentials were supplied in the callback request') if access_token.nil?
+
         verify_hd(access_token)
         access_token
       end
@@ -104,6 +167,54 @@ module OmniAuth
         obj.is_a?(String) ? obj.empty? : obj.nil?
       end
 
+      # Failure messages quote the request: an unknown key names the caller's own
+      # kid header, and a parse error quotes the body. Left alone, a newline in
+      # either forges a log line, so bound the length and flatten control
+      # characters to keep one record per event.
+      def sanitize_for_log(message)
+        message.to_s.gsub(/[[:cntrl:]]/, ' ')[0, LOG_MESSAGE_LIMIT]
+      end
+
+      def trusted_client_ids
+        [options.client_id, *Array(options.authorized_client_ids)].compact.uniq
+      end
+
+      def id_token_claims(token)
+        return @id_token_claims if token == @id_token_claims_token && !@id_token_claims.nil?
+
+        clear_id_token_claims
+
+        # Safe to decode without a key only because every route into
+        # access_token['id_token'] has already established trust: the token
+        # endpoint delivers it over TLS from Google, and a caller-supplied one
+        # is cached here only after verified_id_token has checked its signature.
+        claims = ::JWT.decode(token, nil, false).first
+
+        # We have to manually verify the claims because the third parameter to
+        # JWT.decode is false since no verification key is provided.
+        # required is what makes the rest binding: the individual claim checks
+        # pass silently when a claim is simply absent, so without this a token
+        # missing exp would never expire.
+        ::JWT::Claims.verify_payload!(claims,
+                                      required: REQUIRED_ID_TOKEN_CLAIMS,
+                                      iss: ALLOWED_ISSUERS,
+                                      aud: trusted_client_ids,
+                                      exp: { leeway: options.jwt_leeway },
+                                      nbf: { leeway: options.jwt_leeway })
+
+        cache_id_token_claims(token, claims)
+      end
+
+      def cache_id_token_claims(token, claims)
+        @id_token_claims_token = token
+        @id_token_claims = claims
+      end
+
+      def clear_id_token_claims
+        @id_token_claims_token = nil
+        @id_token_claims = nil
+      end
+
       def callback_url
         options[:redirect_uri] || (full_host + callback_path)
       end
@@ -117,25 +228,138 @@ module OmniAuth
         elsif verifier
           client_get_token(verifier, redirect_uri || callback_url)
         elsif access_token && verify_token(access_token)
-          ::OAuth2::AccessToken.from_hash(client, request.params.dup)
+          ::OAuth2::AccessToken.from_hash(client, direct_token_hash(access_token, request.params['id_token']))
         elsif request.content_type =~ /json/i
           begin
-            body = JSON.parse(request.body.read)
-            request.body.rewind # rewind request body for downstream middlewares
+            raw_body = request.body.read
+            # Rack 3 input streams are not required to be rewindable, so hand
+            # downstream middlewares a fresh stream rather than rewinding this one.
+            request.env['rack.input'] = StringIO.new(raw_body).tap(&:binmode)
+            body = JSON.parse(raw_body)
+            # Valid JSON that is not an object carries no credential, and
+            # indexing it by string would raise rather than fall through.
+            body = nil unless body.is_a?(Hash)
             verifier = body && body['code']
             access_token = body && body['access_token']
             redirect_uri ||= body && body['redirect_uri']
             if verifier
               client_get_token(verifier, redirect_uri || 'postmessage')
             elsif verify_token(access_token)
-              ::OAuth2::AccessToken.from_hash(client, body.dup)
+              ::OAuth2::AccessToken.from_hash(client, direct_token_hash(access_token, body['id_token']))
             end
           rescue JSON::ParserError => e
-            warn "[omniauth google-oauth2] JSON parse error=#{e}"
+            warn "[omniauth google-oauth2] JSON parse error=#{sanitize_for_log(e)}"
           end
         end
       end
 
+      # An id_token supplied by the caller is only as trustworthy as its
+      # signature, so it is carried through only once Google has vouched for it.
+      # Nothing else from the request is: refresh_token and expiry cannot be
+      # verified at all, so they stay dropped.
+      def direct_token_hash(access_token, raw_id_token)
+        hash = { 'access_token' => access_token }
+        id_token = verified_id_token(raw_id_token, access_token)
+        hash['id_token'] = id_token if id_token
+        hash
+      end
+
+      def verified_id_token(raw_id_token, access_token)
+        clear_id_token_claims
+        return nil if nil_or_empty?(raw_id_token)
+
+        # Widening this list means revisiting at_hash_matches?, which hardcodes
+        # SHA-256 because at_hash is defined over the digest named by the token's
+        # own alg header.
+        claims = ::JWT.decode(raw_id_token, nil, true,
+                              algorithms: ['RS256'],
+                              jwks: ->(opts) { google_jwks(force: opts[:invalidate]) },
+                              required_claims: REQUIRED_ID_TOKEN_CLAIMS,
+                              iss: ALLOWED_ISSUERS, verify_iss: true,
+                              aud: trusted_client_ids, verify_aud: true,
+                              verify_expiration: true, exp_leeway: options.jwt_leeway,
+                              verify_not_before: true, nbf_leeway: options.jwt_leeway).first
+        return nil unless same_user?(claims, access_token)
+
+        cache_id_token_claims(raw_id_token, claims)
+        raw_id_token
+      rescue StandardError => e
+        # Fail closed. A token we cannot verify, for any reason including the
+        # key set being unreachable, is discarded rather than trusted.
+        warn "[omniauth google-oauth2] discarding unverified id_token: #{e.class}: #{sanitize_for_log(e.message)}"
+        nil
+      end
+
+      # A signature proves Google issued the id_token, not that it describes the
+      # same person as the access token it arrived beside. Without that, a
+      # genuine id_token for one user could be presented with another user's
+      # access token, leaving uid and extra.id_info describing different people.
+      def same_user?(claims, access_token)
+        return true if at_hash_matches?(claims, access_token)
+
+        subjects_match?(claims, access_token)
+      end
+
+      # at_hash ties an id_token to one specific access token: the left half of
+      # the SHA-256 of that token, base64url encoded. SHA-256 because the digest
+      # follows the token's alg header, which the decode above pins to RS256.
+      # Only a fast path, so absence and mismatch are both just "unproven here",
+      # deferring to the subject check rather than deciding anything.
+      def at_hash_matches?(claims, access_token)
+        expected = claims['at_hash']
+        return false if nil_or_empty?(expected)
+
+        # Encoded with pack rather than Base64, which is a bundled gem as of
+        # Ruby 3.4 and would become a dependency of every host application.
+        # Compared with ==, not a constant-time helper: both sides derive from
+        # the access token the caller just sent, so there is no secret to leak,
+        # and OpenSSL.secure_compare does not exist before Ruby 2.7.
+        digest = ::OpenSSL::Digest::SHA256.digest(access_token)[0, 16]
+        [digest].pack('m0').tr('+/', '-_').delete('=') == expected
+      end
+
+      # The claim that actually matters: does the id_token describe the same
+      # person the access token belongs to? Comparing subjects tests that
+      # directly, where at_hash only tests it by proxy. It also stays correct
+      # when a client refreshes its access token but forwards the id_token it
+      # was originally issued, which is a legitimate at_hash mismatch.
+      def subjects_match?(claims, access_token)
+        subject = claims['sub']
+        return false if nil_or_empty?(subject)
+        return true if subject == userinfo_for(access_token)['sub']
+
+        warn '[omniauth google-oauth2] discarding id_token: subject does not match the access token'
+        false
+      end
+
+      # Memoized into the same ivar raw_info and verify_hd use, so the lookup is
+      # shared rather than repeated. skip_info still governs whether any of this
+      # reaches the auth hash; it trims output, it does not waive the check.
+      def userinfo_for(access_token)
+        @raw_info ||= ::OAuth2::AccessToken.from_hash(client, 'access_token' => access_token).get(USER_INFO_URL).parsed
+      end
+
+      def google_jwks(force: false)
+        # Anchored to this class rather than self.class so that subclasses share
+        # the one cache instead of each looking for state they do not own.
+        GoogleOauth2.cached_jwks(force: force) do
+          # Parsed from the body rather than the response wrapper, which warns
+          # about the JWKS "keys" entry colliding with a built-in Hash method.
+          ::JWT::JWK::Set.new(parse_jwks(client.request(:get, JWKS_URL).body))
+        end
+      end
+
+      # Google returns a small, fixed shape. Anything else is treated as an
+      # outage rather than coerced, since JWT::JWK::Set will happily build a key
+      # set out of surprising input, including an HMAC key from a bare string.
+      def parse_jwks(body)
+        parsed = JSON.parse(body)
+        raise JwksUnavailable, 'JWKS response was not an object' unless parsed.is_a?(Hash)
+        raise JwksUnavailable, 'JWKS response had no keys array' unless parsed['keys'].is_a?(Array)
+
+        parsed
+      end
+
       def client_get_token(verifier, redirect_uri)
         client.auth_code.get_token(verifier, get_token_options(redirect_uri), get_token_params)
       end
@@ -222,8 +446,11 @@ module OmniAuth
       def token_info(access_token)
         return nil unless access_token
 
+        # Keyed on k, not on the access_token this method was first called with:
+        # one request can ask about more than one token, and closing over the
+        # first would file that answer under every later key.
         @token_info ||= Hash.new do |h, k|
-          h[k] = client.request(:post, 'https://www.googleapis.com/oauth2/v3/tokeninfo', body: { access_token: access_token }).parsed
+          h[k] = client.request(:post, 'https://www.googleapis.com/oauth2/v3/tokeninfo', body: { access_token: k }).parsed
         end
 
         @token_info[access_token]
@@ -233,7 +460,7 @@ module OmniAuth
         return false unless access_token
 
         token_info = token_info(access_token)
-        token_info['aud'] == options.client_id || options.authorized_client_ids.include?(token_info['aud'])
+        trusted_client_ids.include?(token_info['aud'])
       end
 
       def verify_hd(access_token)

data/omniauth-google-oauth2.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |gem|
 
   gem.required_ruby_version = '>= 2.5'
 
-  gem.add_dependency 'jwt', '>= 2.9.2'
+  gem.add_dependency 'jwt', '>= 2.9.2', '< 4'
   gem.add_dependency 'oauth2', '~> 2.0'
   gem.add_dependency 'omniauth', '~> 2.0'
   gem.add_dependency 'omniauth-oauth2', '~> 1.8'