DPoP Support #1495

jaredperreault-okta · 2024-02-23T16:34:43Z

No description provided.

shawyu-okta

I see a lot of different casing of "dpop" both in variables and in header names. In general I think the headers might be simplified if we always set them to be lowercase, or at least expect them in lowercase when reading values since headers are supposed to case-insensitive.

Are you tired of typing "DPoP" yet?

lib/errors/WWWAuthError.ts

lib/http/request.ts

lib/oidc/dpop.ts

lib/oidc/exchangeCodeForTokens.ts

lib/oidc/getUserInfo.ts

lib/oidc/handleOAuthResponse.ts

lib/oidc/mixin/index.ts

lib/oidc/options/OAuthOptionsConstructor.ts

README.md

lesterchoi-okta · 2024-04-08T16:07:03Z

lib/errors/WWWAuthError.ts

+    // example string: Bearer error="invalid_token", error_description="The access token is invalid"
+    // regex will match on `error="invalid_token", error_description="The access token is invalid"`
+    // see unit test for more examples of possible www-authenticate values
+    const regex = /(?:,|, )?([a-zA-Z0-9!#$%&'*+-.^_`|~]+)=(?:"([a-zA-Z0-9!#$%&'*+-.^_`|~ /:]+)"|([0-9]+))/g;


yarn run v1.22.19 $ eslint --ext .js,.ts,.jsx . /Users/jared/Code/devex/auth-js/lib/errors/WWWAuthError.ts 62:90 error Unnecessary escape character: \/ no-useless-escape ✖ 1 problem (1 error, 0 warnings) error Command failed with exit code 1.

I think it doesn't need escaping because it's in a [ ]

lesterchoi-okta · 2024-04-08T16:11:35Z

lib/http/request.ts

+    // else {
+    //   // WWWAuthError.parseHeader may return null, only overwrite if !null
+    //   err = wwwAuthErr ?? err;
+    // }


Is this condition reachable?

lesterchoi-okta · 2024-04-08T16:18:59Z

lib/oidc/endpoints/token.ts

+        // throws error is dpop-nonce header cannot be found, prevents infinite loop
+        throw new AuthApiError(
+          {errorSummary: 'No `dpop-nonce` header found when required'},
+          err.resp ?? undefined    // yay ts


lesterchoi-okta · 2024-04-08T16:22:30Z

lib/oidc/endpoints/token.ts

  refreshToken: RefreshToken
 ): Promise<OAuthResponse> {
-  return httpRequest(sdk, {
+  const data = Object.entries({


Not sure what you discussed offline. Did you consider URLSearchParams()?

I did not. This is function was already written and needs to run on Node14, I believe URLSearchParam would require a polyfill for node

Not insisting, but it looks like URLSearchParams is supported since [email protected]

lesterchoi-okta · 2024-04-08T16:26:08Z

lib/oidc/getUserInfo.ts

@@ -36,11 +36,23 @@ export async function getUserInfo<T extends CustomUserClaims = CustomUserClaims>
    return Promise.reject(new AuthSdkError('getUserInfo requires an ID token object'));
  }

-  return httpRequest(sdk, {
+  const options: any = {


nit(ts): Does type inference complain because you delete a property below? Couldn't you add it in generateDPoPProof({...options, accessToken: accessTokenObject.accessToken, keyPair}) to avoid that?

TS never complained about the usage of delete

The delete syntax wasn't the problem I was pointing out. I was saying that removing the property causes TS complain that the types no longer match.

I haven't seen a TS error from this line. httpOptions defines accessToken as an optional prop

lib/oidc/mixin/index.ts

danielzeller-okta · 2024-04-10T14:12:48Z

README.md

+#### Handling `use_dpop_nonce`
+<sub><sup>*Reference: **Resource Server-Provided Nonce** ([RFC9449](https://datatracker.ietf.org/doc/html/rfc9449#name-resource-server-provided-no))*</sub></sup>
+
+> Resource servers can also choose to provide a nonce value to be included in DPoP proofs sent to them. They provide the nonce using the DPoP-Nonce header in the same way that authorization servers do...


nit: It would be more precise to say that the resource server is requiring a nonce (as the error_description describes) rather than providing.

lesterchoi-okta

All the MixedCasingOfDPoP reminds me of AIM. I've reviewed for content and consistency, but I'm not an expert in dpop or plan w.r.t. SDK, so you should probably wait for @mikenachbaur-okta 's review

lesterchoi-okta · 2024-04-15T23:12:47Z

lib/oidc/endpoints/token.ts

  refreshToken: RefreshToken
 ): Promise<OAuthResponse> {
-  return httpRequest(sdk, {
+  const data = Object.entries({


Not insisting, but it looks like URLSearchParams is supported since [email protected]

lesterchoi-okta · 2024-04-15T23:16:27Z

lib/oidc/getUserInfo.ts

@@ -36,11 +36,23 @@ export async function getUserInfo<T extends CustomUserClaims = CustomUserClaims>
    return Promise.reject(new AuthSdkError('getUserInfo requires an ID token object'));
  }

-  return httpRequest(sdk, {
+  const options: any = {


The delete syntax wasn't the problem I was pointing out. I was saying that removing the property causes TS complain that the types no longer match.

lib/oidc/mixin/index.ts

lesterchoi-okta · 2024-04-15T23:20:33Z

test/e2e/specs/dpop.js

+  // widget-based tests cannot be added until new authjs client is updated in siw
+  // xit('can login using signin widget (no redirect)', async () => {
+  //   await bootstrap();
+  //   await loginWidget(flow);
+  //   await TestApp.getUserInfo();
+  //   await TestApp.assertUserInfo();
+  //   await TestApp.logoutRedirect();
+  //   await assertNoRemainingDPoPKeys();
+  // });
+
+  // // widget-based tests cannot be added until new authjs client is updated in siw
+  // xit('can login using signin widget (with redirect)', async () => {
+  //   let options = { forceRedirect: true };
+  //   await bootstrap(options);
+  //   await loginWidget(flow, true);
+  //   await TestApp.getUserInfo();
+  //   await TestApp.assertUserInfo();
+  //   await TestApp.logoutRedirect();
+  //   await assertNoRemainingDPoPKeys();
+  // });


Do these belong in @okta/okta-signin-widget anyway?

perhaps, they already exist in specs/login, which is what I based this file on

might be best to use the downstream okta-auth-js → okta-signin-widget instead of duplicating?

lesterchoi-okta · 2024-04-15T23:30:27Z

test/spec/OktaAuth/api.ts

+jest.mock('../../../lib/oidc/dpop', () => {
+  const actual = jest.requireActual('../../../lib/oidc/dpop');
+  return {
+    __esModule: true,
+    ...actual,
+    ...mocked
+  };
+});


interesting. any notes?

Any note in particular you're looking for? I want to DPoP methods to be tested, but db wrappers (like findKeyPair) can be mocked

guess not. unusual syntax so i was just wondering if there's anything to watch out for

lesterchoi-okta · 2024-04-15T23:31:53Z

test/spec/OktaAuth/api.ts

+      expect(mocked.clearDPoPKeyPair).toHaveBeenCalledWith('foo');
+      expect(mocked.clearAllDPoPKeyPairs).not.toHaveBeenCalled();


is this the new assertion based on my previous question?

lesterchoi-okta · 2024-04-15T23:43:23Z

test/spec/oidc/endpoints/token.ts

+          .mockRejectedValueOnce(new OAuthError('use_dpop_nonce',
+            'Authorization server requires nonce in DPoP proof.',
+            { status: 400, responseText: 'Bad Request', headers: { 'dpop-nonce': 'nonceuponatime' }})


lesterchoi-okta · 2024-04-15T23:44:11Z

test/spec/oidc/getUserInfo.ts

+    generateDPoPProof.mockResolvedValue('dpopproofyay');
+    const httpSpy = jest.spyOn(http, 'httpRequest').mockResolvedValue({
+      'sub': tokens.standardIdTokenParsed.claims.sub,
+      'email': '[email protected]',


I can't take credit for saml jackson, he's a test user

lesterchoi-okta · 2024-04-15T23:46:02Z

test/spec/oidc/renewToken.ts

+          'prompt': 'none'
+        }
+      },
+      time: 1449699929,


Is the hardcoded timestamp ok?

lesterchoi-okta · 2024-04-15T23:47:01Z

test/spec/oidc/util/handleOAuthResponse.ts

+        it('throws if dpop=true and token_type is not DPoP', async () => {
+          let errorThrown = false;
+          try {
+            await handleOAuthResponse(sdk, { responseType: ['token', 'id_token'], dpop: true }, { }, undefined as unknown as CustomUrls);


What's the double as for?

Copied from test(s) above. Doesn't seem to have any affect

I've run into this before where TS complains about a direct cast between "incompatible" types, so you have to cast it to any or unknown in between. 🤷🏼‍♀️

lesterchoi-okta · 2024-04-16T19:25:25Z

lib/errors/WWWAuthError.ts

+    // regex will match on `error="invalid_token", error_description="The access token is invalid"`
+    // see unit test for more examples of possible www-authenticate values
+    // eslint-disable-next-line max-len
+    const regex = /(?:,|, )?([a-zA-Z0-9!#$%&'*+\-.^_`|~]+)=(?:"([a-zA-Z0-9!#$%&'*+\-.,^_`|~ /:]+)"|([a-zA-Z0-9!#$%&'*+\-.^_`|~/:]+))/g;


#1495 (comment)

yarn run v1.22.19 $ eslint --ext .js,.ts,.jsx . /Users/jared/Code/devex/auth-js/lib/errors/WWWAuthError.ts 62:90 error Unnecessary escape character: \/ no-useless-escape ✖ 1 problem (1 error, 0 warnings) error Command failed with exit code 1.

I think because the character is inside a [ ] it doesn't need escaping (where - does)

Let me guess, it doesn't use PCRE but some weird variation? 🤷🏼‍♀️

denysoblohin-okta · 2024-04-17T11:40:04Z

lib/oidc/dpop.ts

+  const signature = await webcrypto.subtle.sign(
+    { name: signingKey.algorithm.name }, signingKey, stringToBuffer(`${head}.${body}`)
+  );
+  return `${head}.${body}.${base64ToBase64Url(bufferToBase64Url(signature))}`;


Looks like function bufferToBase64Url should be actually named bufferToBase64 (as it can contain Base64 padding) ?

Does seem that way, but I think it's a bit out-of-scope to rename it
https://github.com/okta/okta-auth-js/blob/master/lib/crypto/base64.ts#L72

denysoblohin-okta · 2024-04-17T11:54:55Z

lib/oidc/dpop.ts

+  const hash = await webcrypto.subtle.digest('SHA-256', buffer);
+
+  return btoa(String.fromCharCode.apply(null, new Uint8Array(hash) as unknown as number[]))
+    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');


Use bufferToBase64Url and base64ToBase64Url utils?

c5aa7df#diff-a500248e65a86922110daa0dda780cdf1def9b2a13bff7c02c25243d3e312b79R215

I originally had this, but it wasn't working so I wrote the hashAccessToken function. I now see my mistake, I used stringToBuffer AND stringToBase64Url 🤦

denysoblohin-okta · 2024-04-17T12:44:48Z

lib/oidc/dpop.ts

+  const { accessToken, refreshToken } = tokens;
+
+  // revoking access token and refresh token doesn't exist
+  if (revokedToken === 'access' && accessToken && accessToken.tokenType === 'DPoP' && !refreshToken) {


IMHO there's a potential naming confusion between token type

okta-auth-js/lib/oidc/types/Token.ts

Line 25 in 4dc55e9

tokenType: string;

and token kind

okta-auth-js/lib/oidc/types/Token.ts

Line 45 in 4dc55e9

export type TokenType = 'accessToken' | 'idToken' | 'refreshToken';

Maybe add comment to line 25 about possible values (Bearer or DPoP)?

Also, theoretically, the token type is dictated by the .../token endpoint's token_type value. So when populating the authorization header, it should use

Authorization: ${token.token_type} ${token.access_token}

Other types of tokens returned from the server could indicate other token types, but according to the RFC the value must be DPoP. So I think this is safe here.

denysoblohin-okta · 2024-04-17T12:54:17Z

lib/oidc/dpop.ts

+
+/////////// crypto ///////////
+
+export async function writeJwt(header: object, claims: object, signingKey: CryptoKey): Promise<string> {


nit: Maybe change the word write to create ? As this function doesn't write but returns

denysoblohin-okta · 2024-04-17T13:26:36Z

lib/oidc/getUserInfo.ts

+    const keyPair = await findKeyPair(accessTokenObject.dpopPairId);
+    const proof = await generateDPoPProof({ ...options, keyPair });
+    options.headers = {


Reuse getDPoPAuthorizationHeaders util?

Agreed, is there any reason why the util can't be reused here?

mikenachbaur-okta

I have some comments, but overall it looks great

README.md

mikenachbaur-okta · 2024-04-22T22:52:09Z

lib/errors/WWWAuthError.ts

+    // regex will match on `error="invalid_token", error_description="The access token is invalid"`
+    // see unit test for more examples of possible www-authenticate values
+    // eslint-disable-next-line max-len
+    const regex = /(?:,|, )?([a-zA-Z0-9!#$%&'*+\-.^_`|~]+)=(?:"([a-zA-Z0-9!#$%&'*+\-.,^_`|~ /:]+)"|([a-zA-Z0-9!#$%&'*+\-.^_`|~/:]+))/g;


Let me guess, it doesn't use PCRE but some weird variation? 🤷🏼‍♀️

lib/features.ts

mikenachbaur-okta · 2024-04-22T23:01:14Z

lib/oidc/dpop.ts

+  const algorithm = {
+    name: 'RSASSA-PKCS1-v1_5',
+    hash: 'SHA-256',
+    modulusLength: 2048,
+    publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+  };


Do we need to respect the signing algorithms advertised from the openid-configuration endpoint's dpop_signing_alg_values_supported values? Or we might need to add a note or issue to the backlog to acknowledge that we only work with SHA256.

mikenachbaur-okta · 2024-04-22T23:06:16Z

lib/oidc/dpop.ts

+
+// generates a crypto (non-extractable) private key pair and writes it to indexeddb, returns key (id)
+export async function createDPoPKeyPair (): Promise<{keyPair: CryptoKeyPair, keyPairId: string}> {
+  // TODO: clear exist keys when creating new one?


Is this comment still relevant?

mikenachbaur-okta · 2024-04-22T23:10:40Z

lib/oidc/dpop.ts

+  const { accessToken, refreshToken } = tokens;
+
+  // revoking access token and refresh token doesn't exist
+  if (revokedToken === 'access' && accessToken && accessToken.tokenType === 'DPoP' && !refreshToken) {


Also, theoretically, the token type is dictated by the .../token endpoint's token_type value. So when populating the authorization header, it should use

Authorization: ${token.token_type} ${token.access_token}

Other types of tokens returned from the server could indicate other token types, but according to the RFC the value must be DPoP. So I think this is safe here.

mikenachbaur-okta · 2024-04-23T23:20:16Z

lib/oidc/getUserInfo.ts

+    const keyPair = await findKeyPair(accessTokenObject.dpopPairId);
+    const proof = await generateDPoPProof({ ...options, keyPair });
+    options.headers = {


Agreed, is there any reason why the util can't be reused here?

lib/oidc/types/api.ts

test/spec/oidc/getUserInfo.ts

mikenachbaur-okta · 2024-04-29T17:17:53Z

test/spec/http/request.ts

@@ -344,5 +344,7 @@ describe('HTTP Requestor', () => {
          expect(err.meta.acr_values).toEqual('urn:okta:loa:2fa:any:ifpossible');
        });
    });
+
+    // TODO: OAuthError includes response object


@jaredperreault-okta does this test need to be written?

mikenachbaur-okta · 2024-04-29T17:18:37Z

test/spec/oidc/exchangeCodeForTokens.ts


 import { exchangeCodeForTokens, getOAuthUrls } from '../../../lib/oidc';
+// import { generateKeyPair } from '../../../lib/oidc/dpop';


Is this commented-out line still necessary?

mikenachbaur-okta · 2024-04-29T17:19:14Z

test/spec/oidc/renewToken.ts

@@ -10,6 +10,8 @@
 * See the License for the specific language governing permissions and limitations under the License.
 */

+// TODO: mock findKeyPair rather than load indexeddb?


alisaduncan · 2024-08-28T14:21:02Z

lib/errors/WWWAuthError.ts

+// Error thrown after an unsuccessful network request which requires an Authorization header 
+// and returns a 4XX error with a www-authenticate header. The header value is parsed to construct 
+// an error instance, which contains key/value pairs parsed out
+export default class WWWAuthError extends CustomError {


Cool! I wonder if there's a way to leverage this utility for step up auth error responses. Will have to experiment. I ended up having to write my own WWW-Authenticate header parser

jaredperreault-okta force-pushed the jp-OKTA-676066 branch from ef2e4af to a874973 Compare March 18, 2024 15:28

shawyu-okta reviewed Apr 3, 2024

View reviewed changes

jaredperreault-okta marked this pull request as ready for review April 5, 2024 21:01

lesterchoi-okta reviewed Apr 8, 2024

View reviewed changes

danielzeller-okta reviewed Apr 10, 2024

View reviewed changes

jaredperreault-okta force-pushed the jp-OKTA-676066 branch from a29daa9 to 5e8bd34 Compare April 15, 2024 12:35

lesterchoi-okta previously approved these changes Apr 15, 2024

View reviewed changes

jaredperreault-okta dismissed lesterchoi-okta’s stale review via d84d994 April 16, 2024 15:50

lesterchoi-okta reviewed Apr 16, 2024

View reviewed changes

denysoblohin-okta reviewed Apr 17, 2024

View reviewed changes

mikenachbaur-okta previously approved these changes Apr 23, 2024

View reviewed changes

feat: DPoP support

ded5563

jaredperreault-okta dismissed mikenachbaur-okta’s stale review via ded5563 April 24, 2024 15:40

jaredperreault-okta force-pushed the jp-OKTA-676066 branch from d84d994 to ded5563 Compare April 24, 2024 15:40

feedback

98a2f73

mikenachbaur-okta reviewed Apr 24, 2024

View reviewed changes

test/spec/oidc/getUserInfo.ts Show resolved Hide resolved

mikenachbaur-okta reviewed Apr 29, 2024

View reviewed changes

mikenachbaur-okta approved these changes Apr 29, 2024

View reviewed changes

oktapp-aperture-okta bot merged commit ff5354f into master Apr 30, 2024
1 check passed

oktapp-aperture-okta bot deleted the jp-OKTA-676066 branch April 30, 2024 14:37

This was referenced Jun 27, 2024

DPoP support? okta/okta-idx-swift#154

Open

DPoP support? okta/okta-idx-android#204

Open

alisaduncan reviewed Aug 28, 2024

View reviewed changes

Hanumanthareddy884 mentioned this pull request Sep 13, 2024

[Snyk] Upgrade: , , , , , , , , , Hanumanthareddy884/angular17#4

Open

Hanumanthareddy884 mentioned this pull request Sep 14, 2024

[Snyk] Upgrade: , , , , , , , , , tslib, Hanumanthareddy884/angular17#5

Open

	const regex = /(?:,\|, )?([a-zA-Z0-9!#$%&'+-.^_`\|~]+)=(?:"([a-zA-Z0-9!#$%&'+-.^_`\|~ /:]+)"\|([0-9]+))/g;
	const regex = /(?:,\|, )?([a-zA-Z0-9!#$%&'+-.^_`\|~]+)=(?:"([a-zA-Z0-9!#$%&'+-.^_`\|~ \/:]+)"\|([0-9]+))/g;

		expect(mocked.clearDPoPKeyPair).toHaveBeenCalledWith('foo');
		expect(mocked.clearAllDPoPKeyPairs).not.toHaveBeenCalled();


		/////////// crypto ///////////

		export async function writeJwt(header: object, claims: object, signingKey: CryptoKey): Promise<string> {


		import { exchangeCodeForTokens, getOAuthUrls } from '../../../lib/oidc';
		// import { generateKeyPair } from '../../../lib/oidc/dpop';

DPoP Support #1495

DPoP Support #1495

Conversation

jaredperreault-okta commented Feb 23, 2024

shawyu-okta left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lesterchoi-okta left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

denysoblohin-okta Apr 17, 2024 • edited Loading

Choose a reason for hiding this comment

jaredperreault-okta Apr 17, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikenachbaur-okta left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

denysoblohin-okta Apr 17, 2024 •

edited

Loading

jaredperreault-okta Apr 17, 2024 •

edited

Loading