The deprecated key set cache of JKUFactory and X5UFactory ignores the request headers

Abierto
  • ¿Algo no está bien?
#763 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
65/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php, symfony
Área
backend, security

Línea de trabajo

Start with UrlKeySetFactoryTrait::getContent() for 4.3 and UrlKeySetFactory::getContent() for 3.4 through 4.2, as named in the issue. Trace how the URL and request headers are used to build the cache key, then check the existing tests for these factories. Done means cached results for the same URL and different headers are kept separate; the issue also calls for an upgrade note about Vary when replacing this cache with Symfony's CachingHttpClient.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Version(s) affected

3.4.0 to 3.4.12, 4.0.0 to 4.0.8, 4.1.0 to 4.1.10, 4.2.0 to 4.2.5, 4.3.x-dev

Description

With enabledCache(), JKUFactory and X5UFactory store the response under hash('xxh128', $url), although the request also carries the $header argument of loadFromUrl(). A later call for the same URL with other headers gets the document fetched for the first ones, without any request, until the entry expires (3600 s by default). With a pool shared between requests or processes (filesystem, APCu, Redis, a long-running worker), this applies to the whole application.

When an endpoint answers with a different key set per header value (a tenant header, a per-tenant Authorization), the verifier of one tenant receives the keys of another. A genuine token of tenant A then verifies for tenant B, unless an iss/aud check binds tokens to their tenant, and tenant B's own tokens fail until the entry expires.

The bundle never calls enabledCache(). The cache is deprecated since 4.1 (runtime notice from 4.3 on) and goes away in 5.0, but 3.4.x and 4.0.x still present it as a normal feature.

How to reproduce
use Jose\Component\KeyManagement\JKUFactory;
use Symfony\Component\Cache\Adapter\ArrayAdapter;

$factory = new JKUFactory($client); // the endpoint answers with one key set per "X-Tenant" value
$factory->enabledCache(new ArrayAdapter());

$acme = $factory->loadFromUrl('https://keys.example.com/jwks', ['X-Tenant' => 'acme']);
$globex = $factory->loadFromUrl('https://keys.example.com/jwks', ['X-Tenant' => 'globex']);

// $globex holds acme's keys, and the endpoint received a single request.
Possible Solution

Include the headers in the cache key, for example hash('xxh128', serialize([$url, $header])), in UrlKeySetFactoryTrait::getContent() (4.3) and UrlKeySetFactory::getContent() (3.4.x to 4.2.x). Entries stored by an older version are simply no longer read.

Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-QTH1FPG2).

The replacement named by the deprecation, Symfony's CachingHttpClient, keys its entries on the method, the URL, a few standard headers (Authorization, Cookie, Accept*, Host, User-Agent…) and the headers listed in the response's Vary. A key service that selects the document with a custom header must send Vary for that header, or the same mixing happens. Worth a line in the upgrade notes.

Lenguaje dominante
PHP
Estrellas
954
Forks
119
Merge medio
48 min
PR fusionados (30 d)
17

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de web-token/jwt-framework

Todos los issues de web-token/jwt-framework

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.