e15e33fe9b
The external_oauth2_token middleware did not sanitize incoming authentication headers before processing OAuth 2.0 tokens. This allowed an attacker to send forged identity headers (e.g., X-Is-Admin-Project, X-Roles, X-User-Id) that would not be cleared by the middleware, potentially enabling privilege escalation. This fix adds a call to remove_auth_headers() at the start of request processing to sanitize all incoming identity headers, matching the secure behavior of the main auth_token middleware. Closes-Bug: #2129018 Change-Id: Idd4fe1d17a25b3064b31f454d9830242f345e018 Signed-off-by: Jeremy Stanley <fungi@yuggoth.org> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Team and repository tags
Middleware for the OpenStack Identity API (Keystone)
This package contains middleware modules designed to provide
authentication and authorization features to web services other than
Keystone
<https://github.com/openstack/keystone>. The most prominent
module is keystonemiddleware.auth_token. This package does
not expose any CLI or Python API features.
For information on contributing, see
CONTRIBUTING.rst.
- License: Apache License, Version 2.0
- Documentation: https://docs.openstack.org/keystonemiddleware/latest/
- Source: https://opendev.org/openstack/keystonemiddleware
- Bugs: https://bugs.launchpad.net/keystonemiddleware
- Release notes: https://docs.openstack.org/releasenotes/keystonemiddleware/
For any other information, refer to the parent project, Keystone: