Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Public client silent auth requires an account #426

Merged
merged 2 commits into from
Jun 29, 2023
Merged

Conversation

chlowell
Copy link
Collaborator

Silent auth already fails for most public clients when the caller doesn't specify an account, because in that case the client searches the cache for a token having home account ID "" and all user tokens have a nonempty value. However, if a public client shares its cache with a confidential client, it can return the application's token in this case--see #419 (comment) for details. It's unlikely any developer would create that scenario, however it's worth preventing because it can lead to authenticating an unexpected identity, which is dangerous and hard to debug.

@sonarcloud
Copy link

sonarcloud bot commented Jun 22, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 1 Code Smell

No Coverage information No Coverage information
0.0% 0.0% Duplication

@chlowell chlowell mentioned this pull request Jun 22, 2023
@chlowell chlowell marked this pull request as ready for review June 22, 2023 21:04
@chlowell chlowell added the bug Something isn't working label Jun 22, 2023
@chlowell chlowell merged commit 8c5c316 into dev Jun 29, 2023
@chlowell chlowell deleted the chlowell/zero-account branch June 29, 2023 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants