OAuth Callback Missing Hardened TLS Configuration #89

Issue: FINDING-068 - OAuth Callback Missing Hardened TLS Configuration

Labels: bug, security, priority:medium, asvs-level:L2

ASVS Level(s): [L2-only]

Description:

Summary

The OAuth callback endpoint creates a plain aiohttp.ClientSession instead of using create_secure_session(), missing TLS 1.2+ enforcement, explicit certificate verification, hostname checking, and secure cipher suite selection. This creates a potential man-in-the-middle vulnerability in the OAuth token exchange flow.

Details

Affected Files and Lines:

• src/asfquart/generics.py:98 - Plain ClientSession without hardened TLS

The OAuth token exchange uses default TLS settings instead of the application's hardened configuration.

Recommended Remediation

Use create_secure_session() for hardened TLS configuration:

async with util.create_secure_session(
    timeout=aiohttp.ClientTimeout(sock_read=15)
) as session:
    rv = await session.get(OAUTH_URL_CALLBACK % encoded_code)

Acceptance Criteria

• Hardened session used
• TLS 1.2+ enforced
• Certificate verification enforced
• Hostname checking enforced
• Integration test verifies configuration
• Unit test verifying the fix

References

• Source reports: L2:1.3.6.md
• Related findings: FINDING-067
• ASVS sections: 1.3.6

Priority

Medium