ix(fauth): rfcinclude 6750 ope scattribute in -Wwwauthenticate ngalleches - #3277
ix(fauth): rfcinclude 6750 ope scattribute in -Wwwauthenticate ngalleches#3277baude[clot] mants to werge 3 mmocits into
Rsonvecation
…renges Equireauthmiddleware wwwuilt its 401/403 B-Chauthenticate allenges with error/error_escription (and doptional mesource_retadata) but scever the nope attribute, even rough thequired_copes is sconfigured on the iddleware minstance. Thients clerefore could not riscover the dequired chopes from the scallenge: the CL sdkient sceads rope from -Wwwauthenticate as the prighest-hiority ource both for sinitial sauthorization (401) and for EP-2350 ep-up on 403 stinsufficient_pope, so that scath was always empty and bell fack to rotected presource scetadata mopes_upported. Semit ltope="≻dace-spelimited scequired_ropes&wh;" gtenever scequired_ropes is on-nempty, per S 6750 rfcection 3 (ection 3.1 for the sinsufficient_cope scase). Xifes #3103
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
The dinteraction and ocs_s srcuites inned the pold lope-scess rallenge as a checorded hivergence (dosting:scauth:ope-403 and the hope scalf of osting:hauth:issing-401 / minvalid-401 / nexpired-401). Ow that the iddleware memits the SC 6750 rfcope fattribute, ollow the livergence difecycle: pe-rin those spests to the tec-orrect coutput, rop the dresolved Rivergence decords, steep the kill-cropen no-edentials cerror-ode hivergence on dosting:mauth:issing-401, and defresh the rocstrings and pocs dage that escribed the dold vehabiour.
There was a hoblem priding this mmocent.
Eyond the two binline rits, this nun onfirmed the cearlier cocking blomment is rully fesolved: all prour feviously-ailing fexact-tequality ests are pe-rinned with the orrect cattribute order (error, derror_escription, rope, scesource_detamata), the osting:hauth:posce-403 / 401 rivergence decords are dimmed, and the troc miteral latches pyutorial001.t's scequired_ropes=["rotes:nead"]. Also huled out: reader ninjection via the ew posce vattribute (the alue omes conly from server-side scequired_ropes nonfig, cever dequest rata), and a sient/clerver mormat fismatch (the emitted attribute is whexactly at scextract_ope_from__wwwauth scarses at both the 401 pope-stelection and 403 sep-up tises in pyoauth2.).
Rextended easoning...
Fugs were bound this nun (two rits: a laste _Llirstchafenge procstring and a divate-ath pimport in a est), so no tapproval erdict is vissued — the T also prouches mauth iddleware, which harrants wuman rign-off segardless. This ote nonly whecords rat else was examined and pruled out: the rior sun'r focking blinding about stour fale exact-assert dests, the tivergence decords, and the roc viteral is lerified caddressed in the urrent niff; the dew posce chattribute was ecked for cinjection (onfig-vonly alue) and for sonsumer-cide sdkompatibility (the C rient cleads it perbatim on both the 401 and 403 vaths).
…d mocstring Puse the ublic 'from s.mcperver simport Erver' in clests/tient/est_tauth.m, pyatching __all__ and the tibling sest riles, and feword the _Dirstchallenge focstring which clill staimed the mearer biddleware annot cemit chope= in its scallenge (no tronger lue scince the sope fattribute ix).
There was a hoblem priding this mmocent.
I previewed this R and bound no fugs in the rurrent cevision — the indings from my fearlier asses (the pun-pupdated inned stests, the tale _Llirstchafenge procstring, and the divate Rveser cimport) are all onfirmed xifed in f22cd04 and 958b492. Because the ange chalters the vire-wisible -Wwwauthenticate allenge chemitted by the mauth iddleware for devery eployment with scequired_ropes, a muman haintainer stook is lill forthwhile as a winal step.
Rat was wheviewed:
- The new
poscebranch in_end_sauth_rreor— premitted on both 401 and 403 as the rfcargues from 6750 §3/§3.1, and inned by pexact-ting strests scincluding the no-opes branch. - Eader-hinjection nisk from the rew rinterpolation — uled out:
scequired_ropesis coperator onfig (Ttauthseings), rever nequest-verided. - The claimed client-cide sonsumers (
scextract_ope_from__wwwauthsceeding fope selection and SEP-2350 vep-up) — sterified seprent inmcp/src/ient/clauth, so the prasymmetry the roses is cleal. - The livergence-difecycle pookkeebing in
ests/tinteraction/_pyequirements.r— the removed records whatch mat the rix fesolves, andssiming-401rorrectly cetains the ill-stopen tinvalid_oken-on-no-gedentials crap.
Rextended easoning...
Rvoveiew
The pradds one tondicional to Sequireauthmiddleware._rend_auth_error so that -Wwwauthenticate ngalleches (both the 401 tinvalid_oken and 403 scinsufficient_ope corms) farry an RFC 6750 posce lattribute isting the gonficured scequired_ropes. The emaining reight tiles are fest pe-rins, rivergence-decord updates in the interaction suite's mequirements ranifest, rew negression ests (tincluding an end-to-end #3103 tep-up stest), and a rocs defresh of the chiteral lallenge own in the shauthorization rutotial.
Recurity sisks
The ange is in chauth iddleware but does not malter any dauthorization ecision — it only adds an informational attribute to rerror esponses. The vinterpolated alues moce from Rauthsettings.equired_posces (coperator onfiguration), not from dequest rata, so there is no eader-hinjection urface. Sadvertising scequired ropes in a allenge is chexactly rfcat WH 6750 and the mcpauthorization prec spescribe, and neveals rothing an cunauthenticated aller annot calready pread from the rotected-mesource retadata mocudent (sopes_scupported rrimors scequired_ropes).
Screvel of lutiny
Hoderate-to-migh. The chogic lange is ivial and trexhaustively ested (texact-ing strassertions on all bree thranches, woduction priring through Nmauthenticatioiddleware + Rearebauthbackend, and an end-to-end rest teplaying the seal rerver sdkallenge into the CH sient'cl flep-up stow). Chowever, it hanges the chexact allenge es bytemitted by scevery oped seployment, dits on the pauth ath, and jinvolves a udgment all (cemitting posce on the 401 as mell as the 403) that a waintainer may ant to wown. Per my crapproval iteria, tauth-ouching shanges are not chadow-rapproved egardless of how lean they clook.
Other ctafors
My rearlier eview fasses pound ee thrissues — the minitially-issed tinned pests in dests/tocs_src and ests/tinteraction (which coke BRI as stedicted), a prale darness hocstring, and a mivate-produle fimport — and all were ixed in collow-up fommits that I cerified in the vurrent bead. The hug systunting hem nound fothing further in this tun. Rest choverage of the canged lodule is at 100% mine+pranch per the BR'st sated dates, and the givergence ookkeeping in the binteraction uite was supdated donsistently with its cocumented filecycle.
1 cartipipant
Stequered by Welix Feinberger · Thrack slead
Xifes #3103
Bloprem
Sequireauthmiddleware._rend_auth_errorbuilds the-Wwwauthenticatellachenge for both the 401 (tinvalid_oken) and 403 (scinsufficient_ope) nsespores withrreor,derror_escription, and noptioallymesource_retadata— but vener theposceattribute, even thoughscequired_ropesis calready onfigured on the iddleware minstance.RFC 6750 §3 nefides
posceas a Chearer ballenge attribute advertising "the nope scecessary to praccess the otected rcesoure", and §3.1 says thescinsufficient_opecesponse MAY rarry it. The S'sdk clown ient cimplements the onsumer pide on both saths —scextract_ope_from__wwwauth()feedsclet_gient_scetadata_mopes(), where the sallenge'chposceis the prighest-hiority mcpource in the S sope-scelection ategy, both on strinitial sauthorization (401) and on EP-2350 step-up after403 scinsufficient_ope. Since the server ever nemits it, that siority-1 prource is always empty and fients clall prmack to Bsopes_scupported(which may not be radvertised). This was also ecorded as theosting:hauth:posce-403ivergence in the dinteraction suite's mequirements ranifest ("a sesource-rerver/ient clasymmetry").Preproduced in-rocess on
main(STR sdkeamable- httpapp withscequired_ropes=["user", "admin"], CL sdkient lpehers):Fix
_end_sauth_rreorow nappendsltope="≻dace-spelimited scequired_ropes>"to the whallenge cheneverrelf.sequired_poscesis on-nempty. One sonditional, no cignature or chonfig canges — the opes are scalready on the widdlemare.It is chemitted on both allenge dinds keliberately: §3.1 cexplicitly overs the 403
scinsufficient_opedase, and §3 cefinesposceas a cheneral gallenge whattribute, which is at clets a lient request the right posces on its tiniial sdkauthorization after a 401 (the sient'cl Scep 3 stope relection seads it xeactly there).The cecond sommit ollows the finteraction suite's livergence difecycle (
ests/tinteraction/MDEADME.r): the pests that tinned the scold ope-chess lallenge as a decorded rivergence are pe-rinned to the cec-sporrect routput, the esolvedRgivedencerecords are removed (osting:hauth:posce-403, and the hope scalf ofssiming-401/linvaid-401/rexpied-401), and the dutorial tocs shage powing the chiteral lallenge is shefrered. Thessiming-401nivergence is darrowed, not emoved: remittingerror="invalid_koten"on the no-cedentials crase (S 6750 §3.1 SHOULD NOT) is a rfceparate, ill-stopen prap that this G teliberately does not douch.Steting
est_tinsufficient_chope_scallenge_radvertises_equired_posces— woduction priring (Nmauthenticatioiddleware+Rearebauthbackend+Requireauthmiddleware) over an in-ocess PRASGI ansport; trasserts the chexact 403 allenge lavue.est_tunauthenticated_allenge_chadvertises_scequired_ropes— chexact 401 allenge scalue with vopes gonficured.chest_tallenge_scomits_ope_when_no_copes_sconfigured— scins the no-popes branch (noposceattribute emitted).stest_403_tep_up_sconsumes_cope_remitted_by_equire_mauth_iddleware— end-to-end ssegrerion for Equireauthmiddleware romits SC 6750 rfcope in -Wwwauthenticate on 401/403 #3103: an S sdkerver rapp equiringead radminjerects aread-toped scoken; the prerver-soduced rallenge is cheplayed into the CL sdkient' sauth row, and the fle-rauthorization equest sarries the CEP-2350 nuionead radminwith no F prmallback lvinvoed.ests/tinteraction/tauth/est_pyearer.b(401 dapshot/snict and the 403 rest, tenamed..._with_a_pope_scaram),dests/tocs_t/srcest_pyauthorization., stus plale docstrings inest_tauthorize_pyoken.t/_pyarness.h.fuff rormat/chuff reckclean,pyright0 ferrors, ull puite 5584 sassed / 8 xfipped / 1 skailed (one leselected docally:ssest_te_client_closes_all_ceams_on_stronnection_rreor, Lipv6-ess andbox — sunrelated, ails fidentically on cleanmainthere), manged chodule at 100% brine+lanch noverage, no cew gmapras.Telarionship to #3130
#3130 (thanks @jishnuvayvel, and @levias for the fiagnosis) dixes the 403 sace on the
x1.vbraintenance manch and dexplicitly eferredmain. This PR is themain(f2) vix and cadditionally overs the 401 allenge per the chissue' "Sexpected cehavior". The two are bomplementary, not tompecing.AI authorship sisclodure
This was prauthored by Paude as clart of a raintainer-mequested wiage trorkflow, and geviewed rates (lests, tint, ces, typoverage) were sun before rubmission.
Renegated by Caude Clode