Access allowed despite authentication failure
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- javascript, nodejs
- Domain
- authentication, backend, security
Research direction
No files, tests, or entry points are named. Reproduce the reported cases on version 5.6.4 with an active session: Bearer use of a DPoP token, invalid htm and htu values, and an invalid Bearer token. Done means each authentication failure denies resource access rather than allowing the request.
Written by the indexing model from the issue text.
Description
Testing version: 5.6.4
Having got an access token using DPoP, if I make a request to a resource but use the token in Bearer mode instead of signing the request with DPoP again, the request succeeds whilst also reporting access denied.
www-authenticate: [Bearer realm="https://inrupt.net", error="access_denied", error_description="Token does not pass the audience allow filter"]
Similarly, if I create a bad DPoP token using the wrong htm I still get the resource despite:
www-authenticate: [Bearer realm="https://inrupt.net", error="invalid_token", error_description="Invalid PoP token"]
Lastly, creating an invalid DPoP token with a different htu gives me:
www-authenticate: [Bearer realm="https://inrupt.net", error="invalid_token", error_description="htu https://solid-test-suite-alice.inrupt.net/private/asdasd does not match https://solid-test-suite-alice.inrupt.net/private/"]
whilst also succeeding with the request.
I was just about to post this when I thought of other tests I could do. I sent an invalid Bearer token and it still worked:
www-authenticate: [Bearer realm="https://inrupt.net", error="invalid_token", error_description="Access token is not a JWT"]
It seems that having an active session overrides all other security considerations as all the above fail when there is no session.
- Dominant language
- JavaScript
- Stars
- 1.8k
- Forks
- 308
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodeSolidServer/node-solid-server
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
nodeSolidServer/node-solid-server#1848 · 2 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nodeSolidServer/node-solid-server#1841 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nodeSolidServer/node-solid-server#1147 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
nodeSolidServer/node-solid-server#1867 ·
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
nodeSolidServer/node-solid-server#1853 ·
All issues in nodeSolidServer/node-solid-server
Similar issues
-
ai-observability bug team/ai-observability
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
AllTheMods/ATM-10-L#19 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
SignalK/n2k-signalk#345 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
JuliaPluto/PlutoPlotly.jl#72 ·