Pass audience to verify_oauth2_token in get_email_from_bearer_token#5389
Open
herdiyana256 wants to merge 1 commit into
Open
Pass audience to verify_oauth2_token in get_email_from_bearer_token#5389herdiyana256 wants to merge 1 commit into
herdiyana256 wants to merge 1 commit into
Conversation
id_token.verify_oauth2_token() was called without an audience argument. Per its own docstring, when audience is None the audience/aud claim is not verified at all. This function is the sole auth check for the pubsub_push-decorated external_update endpoint, gating on the token's email claim matching the App Engine default service account. Since audience wasn't checked, any validly-signed ID token asserting that same service-account email would be accepted here regardless of what destination it was actually minted for. The App Engine default service account is commonly used broadly across a GCP project, so a token obtained for an entirely different audience (another service or endpoint authenticating with the same identity) could be replayed against this endpoint. Now passes audience=request.url, matching the URL Pub/Sub actually pushed to, which is what a correctly configured OIDC push subscription sets as the token's audience.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
`get_email_from_bearer_token` (src/appengine/libs/auth.py), the sole auth check for the `pubsub_push`-decorated `external_update` endpoint, called `id_token.verify_oauth2_token(token, google_requests.Request())` with no `audience` argument.
Per the function's own docstring, an omitted (`None`) audience means the audience/`aud` claim is not verified at all. The endpoint only checks that the token's `email` claim matches the App Engine default service account, which is commonly shared broadly across a GCP project. Without an audience check, any validly-signed ID token asserting that same service-account email, but minted for a completely different destination, would be accepted here.
Now passes `audience=request.url`, matching the URL Pub/Sub actually pushed to, which is what a correctly configured OIDC push subscription sets as the token's audience.
Added a test (`libs/auth_test.py`, new file — no existing test covered this function) confirming `verify_oauth2_token` is called with the request URL as audience, and that a wrong-audience token is rejected.