python/fastapi-users
1
0
Fork 0
mirror of https://github.com/fastapi-users/fastapi-users.git synced 2026-03-13 07:49:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add a double-submit cookie in the OAuth flow

Browse Source 
Prevents CSRF attacks by ensuring that the state parameter is tied to a cookie.

Fix https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625
This commit is contained in:
François Voron
2025-12-18 16:12:39 +01:00
parent bcee8c9b88
commit 7cf413cd76
4 changed files with 229 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
fastapi_users/router/common.py
View File

@@ -17,6 +17,7 @@ class ErrorCode(str, Enum):
REGISTER_USER_ALREADY_EXISTS = "REGISTER_USER_ALREADY_EXISTS"
OAUTH_NOT_AVAILABLE_EMAIL = "OAUTH_NOT_AVAILABLE_EMAIL"
OAUTH_USER_ALREADY_EXISTS = "OAUTH_USER_ALREADY_EXISTS"
OAUTH_INVALID_STATE = "OAUTH_INVALID_STATE"
LOGIN_BAD_CREDENTIALS = "LOGIN_BAD_CREDENTIALS"
LOGIN_USER_NOT_VERIFIED = "LOGIN_USER_NOT_VERIFIED"
RESET_PASSWORD_BAD_TOKEN = "RESET_PASSWORD_BAD_TOKEN"

120
fastapi_users/router/oauth.py
View File

@@ -1,5 +1,8 @@
import secrets
from typing import Literal
import jwt
from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response, status
from httpx_oauth.integrations.fastapi import OAuth2AuthorizeCallback
from httpx_oauth.oauth2 import BaseOAuth2, OAuth2Token
from pydantic import BaseModel
@@ -12,6 +15,8 @@ from fastapi_users.manager import BaseUserManager, UserManagerDependency
from fastapi_users.router.common import ErrorCode, ErrorModel
STATE_TOKEN_AUDIENCE = "fastapi-users:oauth-state"
CSRF_TOKEN_KEY = "csrftoken"
CSRF_TOKEN_COOKIE_NAME = "fastapiusersoauthcsrf"
class OAuth2AuthorizeResponse(BaseModel):
@@ -25,6 +30,10 @@ def generate_state_token(
return generate_jwt(data, secret, lifetime_seconds)
def generate_csrf_token() -> str:
return secrets.token_urlsafe(32)
def get_oauth_router(
oauth_client: BaseOAuth2,
backend: AuthenticationBackend[models.UP, models.ID],
@@ -33,6 +42,13 @@ def get_oauth_router(
redirect_url: str | None = None,
associate_by_email: bool = False,
is_verified_by_default: bool = False,
*,
csrf_token_cookie_name: str = CSRF_TOKEN_COOKIE_NAME,
csrf_token_cookie_path: str = "/",
csrf_token_cookie_domain: str | None = None,
csrf_token_cookie_secure: bool = True,
csrf_token_cookie_httponly: bool = True,
csrf_token_cookie_samesite: Literal["lax", "strict", "none"] = "lax",
) -> APIRouter:
"""Generate a router with the OAuth routes."""
router = APIRouter()
@@ -55,14 +71,15 @@ def get_oauth_router(
response_model=OAuth2AuthorizeResponse,
)
async def authorize(
request: Request, scopes: list[str] = Query(None)
request: Request, response: Response, scopes: list[str] = Query(None)
) -> OAuth2AuthorizeResponse:
if redirect_url is not None:
authorize_redirect_url = redirect_url
else:
authorize_redirect_url = str(request.url_for(callback_route_name))
state_data: dict[str, str] = {}
csrf_token = generate_csrf_token()
state_data: dict[str, str] = {CSRF_TOKEN_KEY: csrf_token}
state = generate_state_token(state_data, state_secret)
authorization_url = await oauth_client.get_authorization_url(
authorize_redirect_url,
@@ -70,6 +87,17 @@ def get_oauth_router(
scopes,
)
response.set_cookie(
csrf_token_cookie_name,
csrf_token,
max_age=3600,
path=csrf_token_cookie_path,
domain=csrf_token_cookie_domain,
secure=csrf_token_cookie_secure,
httponly=csrf_token_cookie_httponly,
samesite=csrf_token_cookie_samesite,
)
return OAuth2AuthorizeResponse(authorization_url=authorization_url)
@router.get(
@@ -117,18 +145,9 @@ def get_oauth_router(
strategy: Strategy[models.UP, models.ID] = Depends(backend.get_strategy),
):
token, state = access_token_state
account_id, account_email = await oauth_client.get_id_email(
token["access_token"]
)
if account_email is None:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=ErrorCode.OAUTH_NOT_AVAILABLE_EMAIL,
)
try:
decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])
state_data = decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])
except jwt.DecodeError:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
@@ -140,6 +159,28 @@ def get_oauth_router(
detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,
)
cookie_csrf_token = request.cookies.get(csrf_token_cookie_name)
state_csrf_token = state_data.get(CSRF_TOKEN_KEY)
if (
not cookie_csrf_token
or not state_csrf_token
or not secrets.compare_digest(cookie_csrf_token, state_csrf_token)
):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=ErrorCode.OAUTH_INVALID_STATE,
)
account_id, account_email = await oauth_client.get_id_email(
token["access_token"]
)
if account_email is None:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=ErrorCode.OAUTH_NOT_AVAILABLE_EMAIL,
)
try:
user = await user_manager.oauth_callback(
oauth_client.name,
@@ -180,6 +221,13 @@ def get_oauth_associate_router(
state_secret: SecretType,
redirect_url: str | None = None,
requires_verification: bool = False,
*,
csrf_token_cookie_name: str = CSRF_TOKEN_COOKIE_NAME,
csrf_token_cookie_path: str = "/",
csrf_token_cookie_domain: str | None = None,
csrf_token_cookie_secure: bool = True,
csrf_token_cookie_httponly: bool = True,
csrf_token_cookie_samesite: Literal["lax", "strict", "none"] = "lax",
) -> APIRouter:
"""Generate a router with the OAuth routes to associate an authenticated user."""
router = APIRouter()
@@ -208,6 +256,7 @@ def get_oauth_associate_router(
)
async def authorize(
request: Request,
response: Response,
scopes: list[str] = Query(None),
user: models.UP = Depends(get_current_active_user),
) -> OAuth2AuthorizeResponse:
@@ -216,7 +265,8 @@ def get_oauth_associate_router(
else:
authorize_redirect_url = str(request.url_for(callback_route_name))
state_data: dict[str, str] = {"sub": str(user.id)}
csrf_token = generate_csrf_token()
state_data: dict[str, str] = {"sub": str(user.id), CSRF_TOKEN_KEY: csrf_token}
state = generate_state_token(state_data, state_secret)
authorization_url = await oauth_client.get_authorization_url(
authorize_redirect_url,
@@ -224,6 +274,17 @@ def get_oauth_associate_router(
scopes,
)
response.set_cookie(
csrf_token_cookie_name,
csrf_token,
max_age=3600,
path=csrf_token_cookie_path,
domain=csrf_token_cookie_domain,
secure=csrf_token_cookie_secure,
httponly=csrf_token_cookie_httponly,
samesite=csrf_token_cookie_samesite,
)
return OAuth2AuthorizeResponse(authorization_url=authorization_url)
@router.get(
@@ -268,15 +329,6 @@ def get_oauth_associate_router(
user_manager: BaseUserManager[models.UP, models.ID] = Depends(get_user_manager),
):
token, state = access_token_state
account_id, account_email = await oauth_client.get_id_email(
token["access_token"]
)
if account_email is None:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=ErrorCode.OAUTH_NOT_AVAILABLE_EMAIL,
)
try:
state_data = decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])
@@ -291,9 +343,31 @@ def get_oauth_associate_router(
detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,
)
cookie_csrf_token = request.cookies.get(csrf_token_cookie_name)
state_csrf_token = state_data.get(CSRF_TOKEN_KEY)
if (
not cookie_csrf_token
or not state_csrf_token
or not secrets.compare_digest(cookie_csrf_token, state_csrf_token)
):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=ErrorCode.OAUTH_INVALID_STATE,
)
if state_data["sub"] != str(user.id):
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST)
account_id, account_email = await oauth_client.get_id_email(
token["access_token"]
)
if account_email is None:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=ErrorCode.OAUTH_NOT_AVAILABLE_EMAIL,
)
user = await user_manager.oauth_associate_callback(
user,
oauth_client.name,