sts: accept WebIdentityToken from POST body, not only the query string

Abierto
  • ¿Algo no está bien?
#70 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
65/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
rust
Área
api, authentication, backend, security

Línea de trabajo

Comienza leyendo crates/sts/src/route_handler.rs en try_handle_sts y crates/sts/src/request.rs en try_parse_sts_request para seguir cómo se pasa la query al parsing. Confirma el manejo del request body de la ruta STS y, después, haz que los parámetros POST con application/x-www-form-urlencoded funcionen manteniendo el parsing de la query por compatibilidad y dando prioridad al body.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

multistore-sts parses the AssumeRoleWithWebIdentity WebIdentityToken exclusively from the query string. The StsRouterExt handler calls try_handle_sts(req.query, …) (crates/sts/src/route_handler.rs), and try_parse_sts_request is documented as "Extracts AssumeRoleWithWebIdentity parameters from query strings" (crates/sts/src/request.rs). There is no path to supply the token in the request body.

This mirrors the AWS STS Query API convention, but it means the bearer-grade OIDC token always travels in the URL.

Why it matters

URLs leak into far more places than headers or bodies: CDN/edge access logs, reverse-proxy logs, browser history, and the Referer header. A WebIdentityToken captured from any of these within its validity window can be replayed to mint the user's temporary credentials.

A downstream consumer (the Source Cooperative data proxy, which mounts with_sts("/.sts", …)) carefully avoids logging query strings on the STS route, but it cannot prevent intermediaries from capturing the full URL, because the crate offers no body-based alternative.

Request

Allow the WebIdentityToken (and the other AssumeRoleWithWebIdentity params) to be read from an application/x-www-form-urlencoded POST body, matching how the real AWS STS endpoint accepts form-POST requests. Query-string parsing can remain for backwards compatibility, with the body taking precedence when present.

Concretely, try_handle_sts / try_parse_sts_request would need to also accept the request body, and RouteHandler for the STS route would parse POST bodies in addition to the query.

References

  • crates/sts/src/route_handler.rs — try_handle_sts(req.query, …)
  • crates/sts/src/request.rs — try_parse_sts_request(query: Option<&str>)

Filed from a security review of a downstream integration (Source Cooperative data proxy). Happy to help with a PR if the approach sounds right.

Lenguaje dominante
Rust
Estrellas
20
Forks
1
Merge medio
8 h 29 min
PR fusionados (30 d)
2

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de developmentseed/multistore

Todos los issues de developmentseed/multistore

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.