Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-10308

JWT claim check policy failed to match resource and it will skip the claim check if the path parameter with a leading space.

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Workaround Exists
    • Hide

      Use URL rewriting policy to replace all space with %20

      {
  "name": "apicast.policy.url_rewriting",                                   
  "configuration": {
    "commands": [        
      { "op": "sub", "regex": " ", "replace": "%20" }                       
    ]                                                                       
  }                                                                         
},                                                                           
{                                                                           
  "name": "apicast.policy.jwt_claim_check",                                 
  "configuration": {                                                         
    "rules" : [{                                                             
        "operations": [                                                     
            {"op": "matches", "jwt_claim": "{{roles | join: '|'}}", "jwt_claim_type": "liquid",
            "value": "groups:resources:read"}                               
        ],                                                                   
        "combine_op": "and",                                                 
        "methods": ["GET"],                                                 
        "resource": "/groups/{groupid}/deductions$"           
    }]                                                                       
  }
},                   
{ "name": "apicast.policy.apicast" }

                                                              
                                                        

       

      Show
      Use URL rewriting policy to replace all space with %20 { "name" : "apicast.policy.url_rewriting" ,                                     "configuration" : {     "commands" : [               { "op" : "sub" , "regex" : " " , "replace" : "%20" }                           ]                                                                         }                                                                          },                                                                           {                                                                             "name" : "apicast.policy.jwt_claim_check" ,                                   "configuration" : {                                                             "rules" : [{                                                                     "operations" : [                                                                 { "op" : "matches" , "jwt_claim" : "{{roles | join: '|' }}" , "jwt_claim_type" : "liquid" ,             "value" : "groups:resources:read" }                                       ],                                                                           "combine_op" : "and" ,                                                         "methods" : [ "GET" ],                                                         "resource" : "/groups/{groupid}/deductions$"                }]                                                                         } },                    { "name" : "apicast.policy.apicast" }                                                                                                              

      JWT Claim Check policy bypass the JWT check and continues to the backend API if the request URI contain special character such as space. For example " /foo/ bar"

      Mapping Rule:

      GET /groups/{groupID}/deduction$

      Policy configuration

      { 
  "combine_op": "and",
  "methods": [ "GET" ],
  "operations": [
    {
      "op": "matches",
      "jwt_claim_type": "liquid",
      "jwt_claim": "{{ roles | join: '|'}",
      "value_type": "plain",
      "value": "groups:resource:read"
    }
   ],
   "resource": "/groups/{groupID}/deductions$"
}

      When request is sent with invalid JWT role i.e. "policy:resource:crud"

      • GET "/groups/123/deductions$"        => return 403 as expected
      • GET "/groups/ 123/deductions$"       => expected 403 but the request reach backend service and return 200
      • GET "/groups/%20123/deductions$" => also return 200, expected 403

      Examining the code, the observed behavior can be explained as follows

      1. Request URI is captured un-escaped
      2. The policy performs mapping rule matching before checking the jwt token

      Due to (1) the request uri will be captured as "/groups/ 123/deductions" , this will NOT match "/groups/{groupID}/deductions$"  => return false without checking the JWT token

      However, if the uri is  escaped "/groups/ 123/deductions"  become "/groups/%20123/deductions" => this will then match the "/groups/{groupID}/deductions$" and JWT check will be performed => return 403

      The problem also occurs if white space appears in another location, i.e. /foo%20bar/ or /foo%20/bar . Customers also reported that there could be other special characters that could cause this issue. For example: /groups/%0Afoo/deductions

       

       

        1. mapping-rule-validation.png
          mapping-rule-validation.png
          12 kB

              Unassigned Unassigned
              rhn-support-atra An Tran
              Dominik Hlavac Duran Dominik Hlavac Duran
              An Tran An Tran
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: