scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 18:17:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Return a 403 for a bad SSCT instead of 500 (#16112)

Browse Source
This commit is contained in:
Josh Black
2022-06-23 13:01:20 -07:00
committed by GitHub
parent 2220c248d3
commit eb6359bc30
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
changelog/16112.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
core/auth: Return a 403 instead of a 500 for a malformed SSCT
```

7
vault/request_handling.go
View File

@@ -582,13 +582,16 @@ func (c *Core) handleCancelableRequest(ctx context.Context, req *logical.Request
if token == nil {
return logical.ErrorResponse("invalid token"), logical.ErrPermissionDenied
}
// We don't care if the token is an server side consistent token or not. Either way, we're going
// We don't care if the token is a server side consistent token or not. Either way, we're going
// to be returning it for these paths instead of the short token stored in vault.
requestBodyToken = token.(string)
if IsSSCToken(token.(string)) {
token, err = c.CheckSSCToken(ctx, token.(string), c.isLoginRequest(ctx, req), c.perfStandby)
// If we receive an error from CheckSSCToken, we can assume the token is bad somehow, and the client
// should receive a 403 bad token error like they do for all other invalid tokens.
if err != nil {
return nil, fmt.Errorf("server side consistent token check failed: %w", err)
return logical.ErrorResponse("bad token"), logical.ErrPermissionDenied
}
req.Data["token"] = token
}