Skip to content

Commit 7278dcf

Browse files
larrysingleton007larrysingleton007
authored
docs: Correct what _validate_token claims to do (#6689)
* docs: Correct what _validate_token claims to do The method is named validate, its docstring says it validates the token against the OAuth2 server, and the caller logs 'Token successfully validated' afterwards. None of that holds: the bearer scheme only parses an Authorization header, and the method builds that header itself, so every token value passes including the empty string. The token is really verified in _decode_token. Anyone auditing the auth path is misled into thinking a verification step happens here. Describe what the call actually checks (that the discovery document exposes the OAuth2 endpoints) and log that instead. No behavior change: docstring and log message only. Whether the call should exist at all is asked separately in #6688. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * refactor: Rename _validate_token to _check_discovery_endpoints The method never verified the token it takes: it builds a bearer scheme whose header it supplies itself, so any token value passes. What it does check is that the discovery document exposes the OAuth2 endpoints, which is what the docstring already said after the previous commit. Leaving the old name meant the docstring had to spend its opening correcting the name. Private method, single caller in the same file, so the rename is contained. The access_token parameter stays: the bearer scheme requires a well-formed Authorization header, and the caller has the token to hand. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --------- Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>
1 parent fef4e78 commit 7278dcf

1 file changed

Lines changed: 14 additions & 5 deletions

File tree

‎sdk/python/feast/permissions/auth/oidc_token_parser.py‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,18 @@ def _get_jwks_client(self) -> PyJWKClient:
7777
)
7878
return self._jwks_client
7979

80-
async def _validate_token(self, access_token: str):
81-
"""
82-
Validate the token extracted from the header of the user request against the OAuth2 server.
80+
async def _check_discovery_endpoints(self, access_token: str):
81+
"""Check that the provider's discovery document exposes the OAuth2 endpoints.
82+
83+
This does **not** verify *access_token*, despite taking it: the bearer
84+
scheme below only parses an ``Authorization`` header, and this method
85+
supplies that header itself, so any token value passes. The token is
86+
genuinely verified in ``_decode_token``, which checks the signature
87+
against the provider's JWKS and validates the claims.
88+
89+
What can fail here is constructing the scheme, which reads the token
90+
and authorization endpoints from the discovery document. A document
91+
missing either one raises before any token is inspected.
8392
"""
8493
# FastAPI's OAuth2AuthorizationCodeBearer requires a Request type but actually uses only the headers field
8594
# https://github.com/tiangolo/fastapi/blob/eca465f4c96acc5f6a22e92fd2211675ca8a20c8/fastapi/security/oauth2.py#L380
@@ -218,8 +227,8 @@ async def user_details_from_access_token(self, access_token: str) -> User:
218227

219228
# Standard OIDC / Keycloak flow
220229
try:
221-
await self._validate_token(access_token)
222-
logger.debug("Token successfully validated.")
230+
await self._check_discovery_endpoints(access_token)
231+
logger.debug("OIDC discovery document exposes the expected endpoints.")
223232
except Exception as e:
224233
if self._is_ssl_error(e):
225234
logger.error(

0 commit comments

Comments
 (0)