Repository navigation
OAuth Authorization Code Sent in URL Query String to Token Endpoint (OAuth-OIDC) #96
Description
Issue: FINDING-285 - OAuth Authorization Code Sent in URL Query String to Token Endpoint
Labels: bug, security, priority:low, asvs-level:L1
ASVS Level(s): L1
Description:
Summary
The OAuth authorization code is transmitted to the ASF token endpoint via a GET request with the code as a URL query parameter, rather than in an HTTP POST body as recommended by RFC 6749 Section 4.1.3 and OAuth 2.0 Security Best Current Practice (RFC 9700). During the OAuth login flow, after the user authenticates at oauth.apache.org and is redirected back to ATR, the authorization code is received from the OAuth redirect and then placed in the URL query string of a GET request to https://oauth.apache.org/token-oidc?code=AUTHORIZATION_CODE.
Details
In atr/server.py at line 67, src/asfquart/generics.py at line 14, and src/asfquart/generics.py at line 94, the authorization code is transmitted via GET query parameter.
This means the authorization code (a credential) appears in the URL and will be recorded in access logs on oauth.apache.org, any intermediate proxy/load balancer logs, and network monitoring tools performing TLS inspection.
Multiple mitigating factors reduce the risk:
- Server-to-server back-channel communication not exposed to browser
- HTTPS transport security
- Single-use token with 900s expiration
- Referrer-Policy headers prevent leakage
- ATR request logs exclude query strings
Recommended Remediation
Option 1 (Recommended if supported): Switch to POST method for token exchange. Replace GET request with POST request sending the authorization code in the request body using application/x-www-form-urlencoded format with grant_type=authorization_code and code parameter. Contact ASF OAuth service maintainers to confirm POST support.
Option 2 (If POST not supported): Document the accepted risk with inline code comments explaining that the OAuth authorization code is sent via GET query parameter due to upstream ASF OAuth endpoint constraint, and note the mitigating factors: server-to-server HTTPS communication, single-use codes with 900s expiration, immediate exchange, and query string exclusion from request logs.
Acceptance Criteria
- POST method used for token exchange OR risk acceptance documented
- Code comments explain implementation choice
- Unit tests verify token exchange security
References
- Source reports: L1:14.2.1.md
- Related findings: None
- ASVS sections: 14.2.1
Priority
Low
Activity