Repository navigation
oauthex: skip empty list elements in WWW-Authenticate - #1356
Closed
akshita317 wants to merge 1 commit into
Closed
akshita317 wants to merge 1 commit into
akshita317 wants to merge 1 commit into
Conversation
RFC 9110, section 5.6.1, requires recipients to accept and ignore empty list elements, such as the extra comma in Bearer realm="example",, error="insufficient_scope" splitChallenges looked only at the text right after a comma, so the second comma made it end the Bearer challenge there. The rest was parsed as a separate challenge with scheme ",", and error was no longer a Bearer parameter. On a 403, AuthorizationCodeHandler.Authorize then saw no insufficient_scope error and skipped step-up authorization. Skip empty elements when deciding whether a comma separates challenges, and when parsing the parameters of a challenge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Closing as a duplicate of #1351, which fixes the same bug (and was opened first). Sorry for the noise. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 9110, section 5.6.1, requires recipients to accept and ignore empty list elements.
splitChallengeslooked only at the text right after a comma, so inthe second comma ended the Bearer challenge. The rest was parsed as a separate challenge with scheme
",", anderrorwas no longer a Bearer parameter. On a 403,AuthorizationCodeHandler.Authorizethen found noinsufficient_scopeerror and skipped step-up authorization.This skips empty elements both when deciding whether a comma separates challenges and when parsing a challenge's parameters (including a leading
,right after the scheme).Tests:
TestSplitChallenges: empty elements between params and between challenges.TestParseWWWAuthenticateEmptyListElements: leading, doubled, and trailing commas around both challenges;error="insufficient_scope"stays on the Bearer challenge. Fails without the change.AI assistance: prepared with Claude Code.