Problem/Motivation

Originally reported on security.drupal.org, but was deemed ok to discuss in public.

The enable/disable client routes provide an AJAX callback that allows the clients to be enabled/disabled. These routes are vulnerable to CSRF.

Proposed resolution

Add CSRF requirement to the routes.

Issue fork openid_connect-3506413

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

pfrilling created an issue. See original summary.

pfrilling opened merge request !141

pfrilling credited ericgsmith.

pfrilling credited jcnventura.

pfrilling credited mr.baileys.

pfrilling credited mstrelan.

pfrilling’s picture

pfrilling
Location Minster, OH
commented
Status: Active » Reviewed & tested by the community

Marking this as RTBC as the code was already reviewed in a patch on s.d.o.

  • pfrilling committed 8f96b4f0 on 3.x 
    Issue #3506413 by pfrilling, ericgsmith, jcnventura, mr.baileys,...
pfrilling’s picture

pfrilling
Location Minster, OH
commented
Status: Reviewed & tested by the community » Fixed
joseph.olstad’s picture

joseph.olstad
Primary language French
commented
Parent issue: » #3506932: non-existent service "openid_connect.openid_connect" after update

Alpha6 causes an issue in keycloak reported by two others

I'm not sure which change in alpha6 is causing this.

mstrelan’s picture

mstrelan commented
Parent issue: #3506932: non-existent service "openid_connect.openid_connect" after update »

Doesn't make sense for that to be the parent issue, removing.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.