Repository navigation
DockerEndpoint does not validate invalidRequestMessage after parsing authorization request #49009
Description
Description
DockerEndpoint.build() calls AuthorizationEndpointRequestParserProcessor.parseRequest() but does not check authRequest.getInvalidRequestMessage() before proceeding. This means malformed requests (e.g., duplicate query parameters like scope) are accepted and processed instead of being rejected.
In contrast, the OIDC authorization endpoint correctly validates this via AuthorizationEndpointChecker.checkInvalidRequestMessage() after parseRequest(), which rejects requests where getInvalidRequestMessage() is non-null.
Steps to reproduce
- Configure a Docker V2 client with
request.object.requiredset torequest_uri only - Send a request to the Docker auth endpoint with a single
scopeparameter -- observe it is blocked (400) as expected - Send a request with a dupl
10000
icated
scopeparameter -- observe it succeeds (200) and returns a Docker token, bypassing the policy
Expected behavior
The Docker endpoint should reject requests with malformed/duplicate parameters, consistent with the OIDC endpoint behavior.
Actual behavior
The Docker endpoint accepts and processes the request because authRequest.getInvalidRequestMessage() is never checked after parseRequest().
Root cause
In DockerEndpoint.build() (DockerEndpoint.java), after calling parseRequest() the result of authRequest.getInvalidRequestMessage() is ignored. The OIDC path (AuthorizationEndpoint) correctly checks this at line 187 via checker.checkInvalidRequestMessage().
Fix
Add a check for authRequest.getInvalidRequestMessage() in DockerEndpoint.build() after the parseRequest() call, rejecting the request with a 400 if the message is non-null.
This issue was originally tracked in the private repository. Migrated by @abstractj.
Metadata
Metadata
Assignees
Labels
Type
Fields
Projects
- Status
Activity
chore: reject malformed requests in DockerEndpoint
26 remaining items
Reject malformed requests in the docker auth
Reject malformed requests in the docker auth
Reject malformed requests in the docker auth endpoint (keycloak#53042)
Reject malformed requests in the docker auth endpoint (#53042)