Sending access token through request body to oauth2/userinfo

[Yasasr1]

Describe the issue:

Authorization fails when sending access token in request body to /oauth2/userinfo

Steps to reproduce:

1. obtain an access token through basic code flow
2. send request to userinfo end point with access_token in request body

{
"error_description": "Bearer token missing",
"error": "invalid_request"
}

Expected behavior:
Authorization should succeed

Environment information:

• Product Version: IS 5.11.0beta5
• OS: Linux

[emswbandara]

This is a duplicate of #4403

[Migara-Pramod]

I will work on this

[Migara-Pramod]

• Couldn't be able to recreate the issue
• Tested against the pack created using 5.12-m7 relese tag.
• When invoke the /userinfo endpoint with access token in the body get 200 OK as the response.
• postman cURL used to test is as follows.

curl --location --request POST 'https://localhost:9443/oauth2/userinfo'
--header 'Content-Type: application/x-www-form-urlencoded'
--header 'Cookie: JSESSIONID=562B2E9CD5230E660363E2C822118EB43212C6F61157B022CFADD49063AB5C41B82CF692E6A4A06400DE0A1DD269E7A115074727907BD2283B8CC345A57C7EA7A08C270193BF9052C6D9DE6CB0CAB568AB96979E073D378932D20BE9F9F7644756AA9E6794D55B27DEB82E768BA32F7C9C5F4FDF40FB1A69D612B8398FC62F4B; sessionNonceCookie-ac762a4c-3ded-4cf5-a3da-764a184dbaac=a41bf292-396e-419f-a149-1bca8d9a630d'
--data-urlencode 'access_token=e2b74d6f-b4e2-36c5-9e86-322df10761c7'

[Migara-Pramod]

[Migara-Pramod]

I check with yasas and above curl is slightly different from the http request used by the OIDC conformance suite test case. For that curl, issue can be recreated.

curl --location --request POST 'https://localhost:9443/oauth2/userinfo'
--header 'Accept: application/json;charset=UTF-8'
--header 'Accept-Charset: utf-8'
--header 'Content-Type: application/x-www-form-urlencoded;charset=UTF-8'
--data-urlencode 'access_token=09150d18-1056-3ead-ab14-9dc9ad8f3e5f'

The difference is in this curl, server /userinfo endpoint receive content type as 'application/x-www-form-urlencoded;charset=UTF-8'

[Migara-Pramod]

I have debug the code and issue is with the FormUtils class in apache library.
In the class there is a method called isFormPostRequest which return true when content-type exactly match
"application/x-www-form-urlencoded". But in the above senario content-type contains charset.

There is an open bug for for this issue.

https://issues.apache.org/jira/browse/CXF-8347

Also there is an open pull request for the fix

apache/cxf#698

[Migara-Pramod]

@ayshsandu @IsuraD @mefarazath

[mefarazath]

@Migara-Pramod Great finding!
Is the FormUtils class directly used in our code or its used indirectly at the CXF endpoint layer?

[Migara-Pramod]

@Migara-Pramod Great finding!
Is the FormUtils class directly used in our code or its used indirectly at the CXF endpoint layer?

It is used in directly. It is called by the constructor in the HttpServletRequestFilter