rodauth-oauth 0.10.3 → 0.10.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ab7ede677cd918473b708b02509526add2744f96a2cf143c71e79b8d8950f49
-  data.tar.gz: ad19fced98a7f8b62fb856ef0103d09263b1442b33a95adecc9419afe5132ff6
+  metadata.gz: fa43bf0d9c1f6d8ac7a9e2c05b9f9751a68bf0720d47bcdcd92090cdc80b8ec6
+  data.tar.gz: 14101a64005ea99770b2548c3dda8589b06c10cb8d26a4bb30a9e396c301ec17
 SHA512:
-  metadata.gz: e62b0a2586b493c3012e1106c88ec6cdc1dabc6ce5e632526dd81dbf4ef2427a3645449e8ca5484e77e7a41470b09b9ab53df0c1ebc9598a12a62862cefe1b51
-  data.tar.gz: f3b20d4b7566466b40d09e8391b0c73f4f2a1e250ec0aa238af246eed8cc8c9d3a329d6b24369a0a265f1cd0dcd13853941003bca4ce26ce125fcfb5e6e258aa
+  metadata.gz: d5ca40d77877ff713dad6bee5d6424d869a8e6d61101fe87ff18c97372e3c9d8d2acd6fc3450ea8f938582f42740ff5da1326a3501b46e43ada73d1d192592a8
+  data.tar.gz: 4cd099ee6f8e8b5195fb62d8370e46063fa88a1eb3631cad0705fff076d627c891e6cbfc147e7f0c3c4ea651463f611e87c756e93f65b9475322d523f5b101b1

data/doc/release_notes/0_10_3.md

@@ -1,4 +1,4 @@
-### 0.10.2 (29/08/2022)
+### 0.10.3 (29/08/2022)
 
 #### Features
 

data/doc/release_notes/0_10_4.md

@@ -0,0 +1,11 @@
+### 0.10.4 (18/09/2022)
+
+#### Bugfixes
+
+* refresh token lookups are now scoped by application.
+
+This bug meant that lookups of refresh token via the refresh token grant were not scoped by the application identified by the `/token` request credentials, so grant hijacking could happen in theory, if attackers knew of existing refresh tokens.
+
+The same issue was observed (and fixed) for token revocation (this time involving the access token).
+
+* Fix for a case which made resource indicators unusable under Rack 3.0 .

data/lib/rodauth/features/oauth_base.rb

@@ -530,7 +530,7 @@ module Rodauth
     end
 
     def oauth_token_by_refresh_token(token, revoked: false)
-      ds = db[oauth_tokens_table]
+      ds = db[oauth_tokens_table].where(oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column])
       #
       # filter expired refresh tokens out.
       # an expired refresh token is a token whose access token expired for a period longer than the

data/lib/rodauth/features/oauth_jwt.rb

@@ -241,6 +241,16 @@ module Rodauth
       jwt_decode(token)
     end
 
+    def token_from_application?(grant_or_claims, oauth_application)
+      return super if grant_or_claims[oauth_tokens_id_column]
+
+      if grant_or_claims["client_id"]
+        grant_or_claims["client_id"] == oauth_application[oauth_applications_client_id_column]
+      else
+        Array(grant_or_claims["aud"]).include?(oauth_application[oauth_applications_client_id_column])
+      end
+    end
+
     def json_token_introspect_payload(oauth_token)
       return { active: false } unless oauth_token
 

data/lib/rodauth/features/oauth_resource_indicators.rb

@@ -20,7 +20,12 @@ module Rodauth
       if json_request? || param_or_nil("request") # signed request
         resources = Array(resources)
       else
-        query = request.form_data? ? request.body.read : request.query_string
+        query = if request.form_data?
+                  request.body.rewind
+                  request.body.read
+                else
+                  request.query_string
+                end
         # resource query param does not conform to rack parsing rules
         resources = URI.decode_www_form(query).each_with_object([]) do |(k, v), memo|
           memo << v if k == "resource"

data/lib/rodauth/features/oauth_token_introspection.rb

@@ -15,6 +15,7 @@ module Rodauth
       next unless is_authorization_server?
 
       before_introspect_route
+      require_oauth_application
 
       r.post do
         catch_error do

data/lib/rodauth/features/oauth_token_revocation.rb

@@ -74,7 +74,9 @@ module Rodauth
       oauth_token = if param("token_type_hint") == "refresh_token"
                       oauth_token_by_refresh_token(token)
                     else
-                      oauth_token_by_token(token)
+                      oauth_token_by_token_ds(token).where(
+                        oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column]
+                      ).first
                     end
 
       redirect_response_error("invalid_request") unless oauth_token

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "0.10.3"
+    VERSION = "0.10.4"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 0.10.3
+  version: 0.10.4
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-08-29 00:00:00.000000000 Z
+date: 2022-09-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -43,6 +43,7 @@ extra_rdoc_files:
 - doc/release_notes/0_10_1.md
 - doc/release_notes/0_10_2.md
 - doc/release_notes/0_10_3.md
+- doc/release_notes/0_10_4.md
 - doc/release_notes/0_1_0.md
 - doc/release_notes/0_2_0.md
 - doc/release_notes/0_3_0.md
@@ -78,6 +79,7 @@ files:
 - doc/release_notes/0_10_1.md
 - doc/release_notes/0_10_2.md
 - doc/release_notes/0_10_3.md
+- doc/release_notes/0_10_4.md
 - doc/release_notes/0_1_0.md
 - doc/release_notes/0_2_0.md
 - doc/release_notes/0_3_0.md
@@ -117,7 +119,6 @@ files:
 - lib/rodauth/features/oauth_application_management.rb
 - lib/rodauth/features/oauth_assertion_base.rb
 - lib/rodauth/features/oauth_authorization_code_grant.rb
-- lib/rodauth/features/oauth_authorization_server.rb
 - lib/rodauth/features/oauth_authorize_base.rb
 - lib/rodauth/features/oauth_base.rb
 - lib/rodauth/features/oauth_client_credentials_grant.rb
@@ -130,7 +131,6 @@ files:
 - lib/rodauth/features/oauth_management_base.rb
 - lib/rodauth/features/oauth_pkce.rb
 - lib/rodauth/features/oauth_resource_indicators.rb
-- lib/rodauth/features/oauth_resource_server.rb
 - lib/rodauth/features/oauth_saml_bearer_grant.rb
 - lib/rodauth/features/oauth_token_introspection.rb
 - lib/rodauth/features/oauth_token_management.rb

data/lib/rodauth/features/oauth_resource_server.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Rodauth
-  Feature.define(:oauth_resource_server, :OauthResourceServer) do
-    def authorization_token
-      return @authorization_token if defined?(@authorization_token)
-
-      # check if there is a token
-      bearer_token = fetch_access_token
-
-      return unless bearer_token
-
-      # where in resource server, NOT the authorization server.
-      payload = introspection_request("access_token", bearer_token)
-
-      return unless payload["active"]
-
-      @authorization_token = payload
-    end
-  end
-end