Repository navigation
fix(resource): keep MapAAuthResource discovery documents public - #56
Open
KellenCarl wants to merge 1 commit into
Open
KellenCarl wants to merge 1 commit into
KellenCarl wants to merge 1 commit into
Conversation
MapAAuthResource() mapped /.well-known/aauth-resource.json and /.well-known/jwks.json, then added global verification and challenge middleware. Mapped endpoints run at the end of the pipeline, so unsigned discovery GETs (as sent by MetadataClient and any verifier) got 401 and agents could not discover the resource. Verification and challenge now skip only GET requests whose selected endpoint is one of the SDK's discovery handlers, tagged with an internal PublicDiscoveryEndpoint marker. Matching the selected handler rather than the path keeps the exemption tied to the code that actually runs, so a later URL rewrite cannot carry it to a protected endpoint. If no endpoint has been selected yet, the request is verified (fail closed). Tests cover unsigned discovery, protected routes (including app routes under /.well-known, look-alike paths and non-GET methods), the no-key case, a validly signed agent request, and the URL-rewrite case. Fixes aauth-dev#48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #48.
MapAAuthResource()mapped/.well-known/aauth-resource.jsonand/.well-known/jwks.json, then added global verification and challenge middleware. Mapped endpoints run at the end of the pipeline, so unsigned discovery GETs, whichMetadataClientand any verifier send, got401and agents couldn't discover the resource.Changes
GETrequests whose selected endpoint carries a new internalPublicDiscoveryEndpointmarker. The marker is on the resource metadata and JWKS handlers.MapAAuthResource()can't carry the exemption to a protected endpoint (covered by a regression test). If routing hasn't selected an endpoint yet, the request is verified (fail closed)./.well-known, look-alike paths, non-GET methods, andjwks.jsonwhen the resource has no signing keys.Spec basis
Verifiers discover keys from
{iss}/.well-known/{dwk}before they can check any signature (draft-11#jwks-discovery, L2278). Metadata integrity rests on HTTPS plus theissuermatch (#metadata-documents, L1981), not on request signatures. The Person Server and Access Server pipelines already exempt/.well-known.Follow-ups (not in this PR)
/.well-knownprefix; they could use the same handler marker.MapAAuthAgentWellKnown) alongsideMapAAuthResource(), unsigned GETs to/.well-known/aauth-agent.jsonstill get401. Draft-11 has verifiers fetch that document (L473, L539, L1864), so it could take the samePublicDiscoveryEndpointmarker. I've left it out to keep this PR scoped to MapAAuthResource places signature verification in front of its own discovery endpoints #48. Happy to follow up if you'd like.Validation
mcr.microsoft.com/dotnet/sdk:10.0, .NET 10.0.403), Release build: 0 warnings, 0 errors.dotnet test AAuth.slnx -c Release: 3,720 passed, 0 failed, plus the Events gate (89 passed).MapAAuthResourceDiscoveryTests(10 cases). The discovery tests fail onmainand pass with this change.