Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Date: Tue, 25 Oct 2016 18:27:58 +0000 (UTC)
From: "Shaleen Mishra (JIRA)" <jira@apache.org>
To: issues@cxf.apache.org
Message-ID: <JIRA.13015181.1477420018000.81786.1477420078539@Atlassian.JIRA>
In-Reply-To: <JIRA.13015181.1477420018000@Atlassian.JIRA>
References: <JIRA.13015181.1477420018000@Atlassian.JIRA> <JIRA.13015181.1477420018683@arcas>
Subject: [jira] [Created] (CXF-7110) Inflexible jwt audience restriction
 validation
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Tue, 25 Oct 2016 18:28:05 -0000

Shaleen Mishra created CXF-7110:
-----------------------------------

             Summary: Inflexible jwt audience restriction validation
                 Key: CXF-7110
                 URL: https://issues.apache.org/jira/browse/CXF-7110
             Project: CXF
          Issue Type: Improvement
          Components: JAX-RS Security
    Affects Versions: 3.1.7
         Environment: JVM 1.7, Ubuntu 14
            Reporter: Shaleen Mishra


JwtUtils.validateJwtAudienceRestriction checks the audience url matches the current request url (from the context). This works only during development but is most likely to fail because the actual url of the resource server may be behind the proxy or load balancer etc. e.g. The actual request is sent to mycomany.com/oauth and the requester sends this string in the audience parameter but the server actually serving the request may have a url like localhost:8080/oauth. So the match fails. And thanks to the static util function, it can not be customized easily.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)