ep_openid_connect 2.4.0 → 2.5.0

package/index.js

@@ -135,7 +135,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       // userinfo should not be stored in req.session until after all checks have passed. (Otherwise
       // it would be too easy to accidentally introduce a vulnerability.)
       oidcSession.userinfo = userinfo;
-      res.redirect(oidcSession.next || settings.base_url);
+      res.redirect(303, oidcSession.next || settings.base_url);
       // Defer deletion of state until success so that the user can reload the page to retry after a
       // transient backchannel failure.
       delete oidcSession.callbackChecks;
@@ -161,7 +161,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       ...commonParams,
       code_verifier: generators.codeVerifier(), // RFC7636
     };
-    res.redirect(oidcClient.authorizationUrl({
+    res.redirect(303, oidcClient.authorizationUrl({
       ...commonParams,
       // RFC7636
       code_challenge: generators.codeChallenge(oidcSession.callbackChecks.code_verifier),
@@ -174,7 +174,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       logger.warn('Not configured; ignoring request.');
       return next();
     }
-    req.session.destroy(() => res.redirect(settings.base_url));
+    req.session.destroy(() => res.redirect(303, settings.base_url));
   });
 };
 
@@ -206,9 +206,41 @@ exports.authenticate = (hookName, {req, res, users}) => {
 
 exports.authnFailure = (hookName, {req, res}) => {
   if (oidcClient == null) return;
+  // Normally the user is redirected to the login page which would then redirect the user back once
+  // authenticated. For non-GET requests, send a 401 instead because users can't be redirected back.
+  // Also send a 401 if an Authorization header is present to facilitate API error handling.
+  //
+  // 401 is the status that most closely matches the desired semantics. However, RFC7235 section
+  // 3.1 says, "The server generating a 401 response MUST send a WWW-Authenticate header field
+  // containing at least one challenge applicable to the target resource." Etherpad uses a token
+  // (signed session identifier) transmitted via cookie for authentication, but there is no
+  // standard authentication scheme name for that. So we use a non-standard name here.
+  //
+  // We could theoretically implement Bearer authorization (RFC6750), but it's unclear to me how
+  // to do this correctly and securely:
+  //   * The userinfo endpoint is meant for the OAuth client, not the resource server, so it
+  //     shouldn't be used to look up claims.
+  //   * In general, access tokens might be opaque (not JWTs) so we can't get claims by parsing
+  //     them.
+  //   * The token introspection endpoint should return scope and subject (I think?), but probably
+  //     not claims.
+  //   * If claims can't be used to convey access level, how is it conveyed? Scope? Resource
+  //     indicators (RFC8707)?
+  //   * How is intended audience checked? Or is introspection guaranteed to do that for us?
+  //   * Should tokens be limited to a particular pad?
+  //   * Bearer tokens are only meant to convey authorization; authentication is handled by the
+  //     authorization server. Should Bearer tokens be processed during the authorize hook?
+  //   * How should bearer authentication interact with authorization plugins?
+  //   * How should bearer authentication interact with plugins that add new endpoints?
+  //   * Would we have to implement our own OAuth server to issue access tokens?
+  res.header('WWW-Authenticate', 'Etherpad');
+  if (!['GET', 'HEAD'].includes(req.method) || req.headers.authorization) {
+    res.status(401).end();
+    return true;
+  }
   if (req.session.ep_openid_connect == null) req.session.ep_openid_connect = {};
   req.session.ep_openid_connect.next = new URL(req.url.slice(1), settings.base_url).toString();
-  res.redirect(endpointUrl('login'));
+  res.redirect(303, endpointUrl('login'));
   return true;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {

package/static/tests/backend/login.js

@@ -6,7 +6,7 @@ const common = require('ep_etherpad-lite/tests/backend/common');
 const logger = common.logger;
 
 const followRedirects = async (agent, res) => {
-  if (![302, 303].includes(res.status)) return res;
+  if (res.status !== 303) return res;
   const url = new URL(res.headers.location, res.request.url);
   logger.debug(`redirected to ${url}`);
   return await followRedirects(agent, await agent.get(url));

package/static/tests/backend/specs/tests.js

@@ -64,13 +64,13 @@ describe(__filename, function () {
 
   it('not logged in redirects to login endpoint', async function () {
     await agent.get(common.baseUrl)
-        .expect(302)
+        .expect(303)
         .expect('location', new URL('/ep_openid_connect/login', common.baseUrl).toString());
   });
 
   it('login endpoint redirects to authorization URL', async function () {
     await agent.get(new URL('/ep_openid_connect/login', common.baseUrl))
-        .expect(302)
+        .expect(303)
         .expect('location', /.*/)
         .expect((res) => {
           assert(res.headers.location.startsWith(`${new URL('/auth', issuer)}?`));
@@ -205,13 +205,24 @@ describe(__filename, function () {
     assert.equal(res.request.url, url);
     assert.equal(res.status, 200);
     await agent.get(new URL('/ep_openid_connect/logout', common.baseUrl))
-        .expect(302)
+        .expect(303)
         .expect('location', new URL('/', common.baseUrl).toString());
     // Visiting any page that requires authentication should now redirect to the login page.
     await agent.get(new URL('/', common.baseUrl))
-        .expect(302)
-        .expect('location', /./)
-        .expect((res) => assert(res.headers.location.startsWith(
-            new URL('/ep_openid_connect/login', common.baseUrl).toString())));
+        .expect(303)
+        .expect('location', new URL('/ep_openid_connect/login', common.baseUrl).toString());
+  });
+
+  it('HTTP PUT gives 401 instead of redirect', async function () {
+    await agent.put(common.baseUrl)
+        .expect(401)
+        .expect('www-authenticate', 'Etherpad');
+  });
+
+  it('Authorization header results in 401 instead of redirect', async function () {
+    await agent.get(common.baseUrl)
+        .set('Authorization', 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=')
+        .expect(401)
+        .expect('www-authenticate', 'Etherpad');
   });
 });