LI80628: INCORRECT REDIRECTION POSSIBLE WITH BAD RSTATE IN OAUTH

APAR status

• Closed as fixed if next.

Error description

• During Authorization Code grant type, user can be re-directed
  to invalid redirect_uri if an bad rstate value is present in
  the query.
  

Local fix

• Check for redirect_uri during the presence of bad rstate.
  Change the response from redirecting to the provided redirect
  uri to responding with a Invalid Redirect_URI.
  

Problem summary

• Current design of redirect_uri in-conjunction with bad rstate
  allowed redirection for all incoming redirect_uris. This occured
  even in cases where the request's redirect_uri did not match the
  one configured in the application. The issue would stop at this
  point with no further steps in OAuth possible.
  

Problem conclusion

Temporary fix

Comments

• Fixed check for redirect_uri being skipped incase of rstate
  (redirect state) being present in the authorization code
  request. Now, if a request's redirect_Uri does not match the
  oneconfigured, Invalid redirect error is sent.
  Issue fixed from next release 5086.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels