test(auth): regression coverage for azure-ad-hybrid OAuth state + id_token verification
test: regression coverage for azure-ad-hybrid OAuth state + id_token verification
Companion test PR to the fix in #3070 for the CRITICAL finding "azure-ad-hybrid OAuth callback skips state validation and trusts a client-supplied id_token" (CVSS 9.3, CWE-347).
Depends on / pairs with the fix branch fix/azure-ad-hybrid-oauth-state-idtoken.
Why
The vulnerability was silent: the callback happily minted a session for a forged, unsigned (alg=none) id_token and never touched the OAuth state cookie, yet no test asserted either behaviour. These tests lock the guardrails in so the flaw cannot regress.
What these tests assert
In backend/tests/test_server.py:
| Test | Assertion |
|---|---|
test_azure_hf_callback_missing_state_redirects | A callback with no state form field is rejected before the app oauth_callback runs. |
test_azure_hf_callback_missing_id_token_redirects | A callback with no id_token is rejected. |
test_azure_hf_callback_rejects_forged_id_token | When id_token verification fails, the request redirects to the login error and no access_token cookie is set. |
test_azure_hf_callback_verifies_id_token_with_login_nonce | Verification receives the exact id_token and the nonce bound to the login (oauth_nonce cookie). |
test_azure_hf_login_nonce_differs_per_request | Two independent authorization requests produce different nonces (no process-lifetime reuse). |
Note on the nonce test
test_azure_hf_login_nonce_differs_per_request exercises the fix in #3070 where the per-login nonce moved from a module-import-frozen provider instance into oauth_login. It will fail against main and pass once the fix is merged.
Scan
Scan ID: cmuwxf0uj0073lf01nna76pt1 · Finding: cmux90q9j00cvlf01x8qc9wna
⚠️ Automated security PR. Tests are additive only.
Summary by cubic
Adds regression tests for the azure-ad-hybrid OAuth callback hardening from #3070, which closed a vulnerability where the callback skipped state validation and trusted a client-supplied, forged id_token.
The new tests assert that:
- Callbacks missing the state or id_token form field are rejected before the app
oauth_callbackruns. - A forged id_token that fails verification redirects to the login error and sets no
access_tokencookie. - id_token verification receives the exact token and the nonce bound to the login (
oauth_noncecookie). - Two independent authorization requests produce different nonces.
test_azure_hf_login_nonce_differs_per_request fails against main and passes once the fix in #3070 is merged. Tests are additive only.