fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv) (#9668)
This commit is contained in:
Manuel
GitHub
305
spec/Adapters/Auth/oauth2.spec.js
Normal file
305
spec/Adapters/Auth/oauth2.spec.js
Normal file
@@ -0,0 +1,305 @@
|
||||
const OAuth2Adapter = require('../../../lib/Adapters/Auth/oauth2').default;
|
||||
|
||||
describe('OAuth2Adapter', () => {
|
||||
let adapter;
|
||||
|
||||
const validOptions = {
|
||||
tokenIntrospectionEndpointUrl: 'https://provider.com/introspect',
|
||||
useridField: 'sub',
|
||||
appidField: 'aud',
|
||||
appIds: ['valid-app-id'],
|
||||
authorizationHeader: 'Bearer validAuthToken',
|
||||
};
|
||||
|
||||
beforeEach(() => {
|
||||
adapter = new OAuth2Adapter.constructor();
|
||||
adapter.validateOptions(validOptions);
|
||||
});
|
||||
|
||||
describe('validateAppId', () => {
|
||||
it('should validate app ID successfully', async () => {
|
||||
const authData = { access_token: 'validAccessToken' };
|
||||
const mockResponse = {
|
||||
[validOptions.appidField]: 'valid-app-id',
|
||||
};
|
||||
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockResponse),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
await expectAsync(
|
||||
adapter.validateAppId(validOptions.appIds, authData, validOptions)
|
||||
).toBeResolved();
|
||||
});
|
||||
|
||||
it('should throw an error if app ID is invalid', async () => {
|
||||
const authData = { access_token: 'validAccessToken' };
|
||||
const mockResponse = {
|
||||
[validOptions.appidField]: 'invalid-app-id',
|
||||
};
|
||||
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockResponse),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
await expectAsync(
|
||||
adapter.validateAppId(validOptions.appIds, authData, validOptions)
|
||||
).toBeRejectedWithError('OAuth2: Invalid app ID.');
|
||||
});
|
||||
});
|
||||
|
||||
describe('validateAuthData', () => {
|
||||
it('should validate auth data successfully', async () => {
|
||||
const authData = { id: 'user-id', access_token: 'validAccessToken' };
|
||||
const mockResponse = {
|
||||
active: true,
|
||||
[validOptions.useridField]: 'user-id',
|
||||
};
|
||||
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockResponse),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
await expectAsync(
|
||||
adapter.validateAuthData(authData, null, validOptions)
|
||||
).toBeResolvedTo({});
|
||||
});
|
||||
|
||||
it('should throw an error if the token is inactive', async () => {
|
||||
const authData = { id: 'user-id', access_token: 'validAccessToken' };
|
||||
const mockResponse = { active: false };
|
||||
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockResponse),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
await expectAsync(
|
||||
adapter.validateAuthData(authData, null, validOptions)
|
||||
).toBeRejectedWith(new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'OAuth2 access token is invalid for this user.'));
|
||||
});
|
||||
|
||||
it('should throw an error if user ID does not match', async () => {
|
||||
const authData = { id: 'user-id', access_token: 'validAccessToken' };
|
||||
const mockResponse = {
|
||||
active: true,
|
||||
[validOptions.useridField]: 'different-user-id',
|
||||
};
|
||||
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockResponse),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
await expectAsync(
|
||||
adapter.validateAuthData(authData, null, validOptions)
|
||||
).toBeRejectedWithError('OAuth2 access token is invalid for this user.');
|
||||
});
|
||||
});
|
||||
|
||||
describe('requestTokenInfo', () => {
|
||||
it('should fetch token info successfully', async () => {
|
||||
const mockResponse = { active: true };
|
||||
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockResponse),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
const result = await adapter.requestTokenInfo(
|
||||
'validAccessToken',
|
||||
validOptions
|
||||
);
|
||||
|
||||
expect(result).toEqual(mockResponse);
|
||||
});
|
||||
|
||||
it('should throw an error if the introspection endpoint URL is missing', async () => {
|
||||
const options = { ...validOptions, tokenIntrospectionEndpointUrl: null };
|
||||
|
||||
expect(
|
||||
() => adapter.validateOptions(options)
|
||||
).toThrow(new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'OAuth2 token introspection endpoint URL is missing.'));
|
||||
});
|
||||
|
||||
it('should throw an error if the response is not ok', async () => {
|
||||
mockFetch([
|
||||
{
|
||||
url: validOptions.tokenIntrospectionEndpointUrl,
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: false,
|
||||
statusText: 'Bad Request',
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
await expectAsync(
|
||||
adapter.requestTokenInfo('invalidAccessToken')
|
||||
).toBeRejectedWithError('OAuth2 token introspection request failed.');
|
||||
});
|
||||
});
|
||||
|
||||
describe('OAuth2Adapter E2E Tests', () => {
|
||||
beforeEach(async () => {
|
||||
// Simulate reconfiguring the server with OAuth2 auth options
|
||||
await reconfigureServer({
|
||||
auth: {
|
||||
mockOauth: {
|
||||
tokenIntrospectionEndpointUrl: 'https://provider.com/introspect',
|
||||
useridField: 'sub',
|
||||
appidField: 'aud',
|
||||
appIds: ['valid-app-id'],
|
||||
authorizationHeader: 'Bearer validAuthToken',
|
||||
oauth2: true
|
||||
},
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('should validate and authenticate user successfully', async () => {
|
||||
mockFetch([
|
||||
{
|
||||
url: 'https://provider.com/introspect',
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve({
|
||||
active: true,
|
||||
sub: 'user123',
|
||||
aud: 'valid-app-id',
|
||||
}),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
const authData = { access_token: 'validAccessToken', id: 'user123' };
|
||||
const user = await Parse.User.logInWith('mockOauth', { authData });
|
||||
|
||||
expect(user.id).toBeDefined();
|
||||
expect(user.get('authData').mockOauth.id).toEqual('user123');
|
||||
});
|
||||
|
||||
it('should reject authentication for inactive token', async () => {
|
||||
mockFetch([
|
||||
{
|
||||
url: 'https://provider.com/introspect',
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ active: false, aud: ['valid-app-id'] }),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
const authData = { access_token: 'inactiveToken', id: 'user123' };
|
||||
await expectAsync(Parse.User.logInWith('mockOauth', { authData })).toBeRejectedWith(
|
||||
new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'OAuth2 access token is invalid for this user.')
|
||||
);
|
||||
});
|
||||
|
||||
it('should reject authentication for mismatched user ID', async () => {
|
||||
mockFetch([
|
||||
{
|
||||
url: 'https://provider.com/introspect',
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve({
|
||||
active: true,
|
||||
sub: 'different-user',
|
||||
aud: 'valid-app-id',
|
||||
}),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
const authData = { access_token: 'validAccessToken', id: 'user123' };
|
||||
await expectAsync(Parse.User.logInWith('mockOauth', { authData })).toBeRejectedWith(
|
||||
new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'OAuth2 access token is invalid for this user.')
|
||||
);
|
||||
});
|
||||
|
||||
it('should reject authentication for invalid app ID', async () => {
|
||||
mockFetch([
|
||||
{
|
||||
url: 'https://provider.com/introspect',
|
||||
method: 'POST',
|
||||
response: {
|
||||
ok: true,
|
||||
json: () => Promise.resolve({
|
||||
active: true,
|
||||
sub: 'user123',
|
||||
aud: 'invalid-app-id',
|
||||
}),
|
||||
},
|
||||
},
|
||||
]);
|
||||
|
||||
const authData = { access_token: 'validAccessToken', id: 'user123' };
|
||||
await expectAsync(Parse.User.logInWith('mockOauth', { authData })).toBeRejectedWithError(
|
||||
'OAuth2: Invalid app ID.'
|
||||
);
|
||||
});
|
||||
|
||||
it('should handle error when token introspection endpoint is missing', async () => {
|
||||
await reconfigureServer({
|
||||
auth: {
|
||||
mockOauth: {
|
||||
tokenIntrospectionEndpointUrl: null,
|
||||
useridField: 'sub',
|
||||
appidField: 'aud',
|
||||
appIds: ['valid-app-id'],
|
||||
authorizationHeader: 'Bearer validAuthToken',
|
||||
oauth2: true
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const authData = { access_token: 'validAccessToken', id: 'user123' };
|
||||
await expectAsync(Parse.User.logInWith('mockOauth', { authData })).toBeRejectedWith(
|
||||
new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'OAuth2 token introspection endpoint URL is missing.')
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
});
|
||||
Reference in New Issue
Block a user