OAuth Authorization Code Sent in URL Query String to Token Endpoint (OAuth-OIDC)

[andrewmusselman]

Issue: FINDING-285 - OAuth Authorization Code Sent in URL Query String to Token Endpoint

Labels: bug, security, priority:low, asvs-level:L1

ASVS Level(s): L1

Description:

Summary

The OAuth authorization code is transmitted to the ASF token endpoint via a GET request with the code as a URL query parameter, rather than in an HTTP POST body as recommended by RFC 6749 Section 4.1.3 and OAuth 2.0 Security Best Current Practice (RFC 9700). During the OAuth login flow, after the user authenticates at oauth.apache.org and is redirected back to ATR, the authorization code is received from the OAuth redirect and then placed in the URL query string of a GET request to https://oauth.apache.org/token-oidc?code=AUTHORIZATION_CODE.

Details

In atr/server.py at line 67, src/asfquart/generics.py at line 14, and src/asfquart/generics.py at line 94, the authorization code is transmitted via GET query parameter.

This means the authorization code (a credential) appears in the URL and will be recorded in access logs on oauth.apache.org, any intermediate proxy/load balancer logs, and network monitoring tools performing TLS inspection.

Multiple mitigating factors reduce the risk:

1. Server-to-server back-channel communication not exposed to browser
2. HTTPS transport security
3. Single-use token with 900s expiration
4. Referrer-Policy headers prevent leakage
5. ATR request logs exclude query strings

Recommended Remediation

Option 1 (Recommended if supported): Switch to POST method for token exchange. Replace GET request with POST request sending the authorization code in the request body using application/x-www-form-urlencoded format with grant_type=authorization_code and code parameter. Contact ASF OAuth service maintainers to confirm POST support.

Option 2 (If POST not supported): Document the accepted risk with inline code comments explaining that the OAuth authorization code is sent via GET query parameter due to upstream ASF OAuth endpoint constraint, and note the mitigating factors: server-to-server HTTPS communication, single-use codes with 900s expiration, immediate exchange, and query string exclusion from request logs.

Acceptance Criteria

• POST method used for token exchange OR risk acceptance documented
• Code comments explain implementation choice
• Unit tests verify token exchange security

References

• Source reports: L1:14.2.1.md
• Related findings: None
• ASVS sections: 14.2.1

Priority

Low