Trouble with OIDC Cors Preflight Request

[Armando Martins]

Just found my error.

I've misunderstood the parameter cors.allowed.headers.

After adding the header x-xsrf-token in the allowed CORS headers the
preflight request is working fine now.

Best,

Le ven. 24 févr. 2023 à 17:20, Armando Martins <armando.mart1s at gmail.com> a
écrit :

> Hi,
>
> after capturing my preflight request with burp, i noticed tha if i remove
> one of the headers Access-Control-Request-Method
> or Access-Control-Request-Headers i don't get a 403 anymore.
>
> Here is the original request :
>
> OPTIONS
> /idp/profile/oidc/authorize?response_type=code&scope=openid%20profile&client_id=SP_OIDC&state=1XGHHV0FzPtHlWS-W2_f02OjYZ8&redirect_uri=https%3A%2F%
> 2Fsp.exemple.net%2Fredirect_uri&nonce=2Eq94_7UwIuHlJvLiQ-uMa-mSmjO2oH7Jm7jE1bC2-s
> HTTP/2
> Host: idp.exemple.net
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
> Firefox/102.0
> Accept: */*
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Access-Control-Request-Method: GET
> Access-Control-Request-Headers: x-xsrf-token
> Referer: https://sp.exemple.net/
> Origin: https://sp.exemple.net
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: cross-site
> Te: trailers
>
> And the Response of this Preflight request is :
>
> HTTP/2 403 Forbidden
> Set-Cookie: JSESSIONID=C7855D0EDF2C4872ECF6BB75553B5FD9; Path=/idp;
> Secure; HttpOnly
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 0
> Date: Fri, 24 Feb 2023 16:11:15 GMT
>
> But if i remove the Access-Control-Request-Headers from my original
> request i get this response :
>
> HTTP/2 200 OK
> Set-Cookie: JSESSIONID=D59167C7F37379274B87FB83377E09AC; Path=/idp;
> Secure; HttpOnly
> Vary: origin,access-control-request-method,Access-Control-Request-Headers
> Access-Control-Allow-Origin: https://sp.exemple.net
> Access-Control-Allow-Credentials: true
> Access-Control-Max-Age: 1800
> Access-Control-Allow-Methods: HEAD,POST,GET,OPTIONS
> Access-Control-Allow-Headers:
> authorization,origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
> Content-Length: 0
> Date: Fri, 24 Feb 2023 16:13:31 GMT
>
> I also disabled the CSRF Protection by adding "idp.csrf.enabled = false"
> to my IDP and the result is the same.... So that's not the problem.
>
> If someone, have an idea on what i'm missing, any help would be greatly
> appreciated.
>
> Best,
>
> Le jeu. 23 févr. 2023 à 17:45, Armando Martins <armando.mart1s at gmail.com>
> a écrit :
>
>> Hi,
>>
>> I'm trying to use the OIDC plugin with Shibboleth 4.2.1.
>>
>> All is working fine except when the service provider try to renew the
>> cookie after 10mn of inactivity.
>>
>> In fact, after client inactivity the browser try to do a Cors Preflight
>> request. But the request fails with  a 403 status.
>>
>> that seems related to the cross-site request forgery mitigation but i
>> can't find out a good way to put an exception on the oidc profile endpoint.
>>
>> Here is the Cors configuration that i put in my idp webapp web.xml :
>>
>> <!-- Cors Authorization -->
>> <filter>
>>   <filter-name>CorsFilter</filter-name>
>>   <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
>>   <init-param>
>>     <param-name>cors.allowed.origins</param-name>
>>     <param-value>
>>         https://sp.exemple.net
>>     </param-value>
>>   </init-param>
>>   <init-param>
>>     <param-name>cors.allowed.methods</param-name>
>>     <param-value>GET,POST,HEAD,OPTIONS</param-value>
>>   </init-param>
>>   <init-param>
>>     <param-name>cors.allowed.headers</param-name>
>>     <param-value>
>>         Origin,
>>         X-Requested-With,
>>         Content-Type, Accept,
>>         Access-Control-Request-Method,
>>         Access-Control-Request-Headers,
>>         Authorization
>>     </param-value>
>>   </init-param>
>>   <init-param>
>>     <param-name>cors.support.credentials</param-name>
>>     <param-value>true</param-value>
>>   </init-param>
>> </filter>
>>
>> <filter-mapping>
>>   <filter-name>CorsFilter</filter-name>
>>   <url-pattern>/profile/oidc/*</url-pattern>
>> </filter-mapping>
>>
>> Here is the configuration i'm using on the service provider :
>>
>> Debian 11 with apache2.4.54 and mod-auth-openidc 2.4.9
>>
>> And on my identity provider :
>>
>> Debian 11 with tomcat9.0.43, shibboleth 4.2.1 with idp-plugin-oidc-op
>> 3.0.0
>>
>> Thanks in advance for your help.
>>
>> Best,
>>
>>
>> --
>> Armando Martins
>>
>
>
> --
> Armando Martins
>


-- 
Armando Martins
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230224/2325834e/attachment.htm>