[SOLR-15434] Change JWT OAuth grant type to Authorization code instead of implicit for UI

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Component/s: security
• Labels: JWT authentication
• Assignee: Jan Høydahl
• Reporter: Chelambarasan
• Created: 25/May/21 14:13
• Updated: 04/Aug/23 13:55
• Resolved: 04/Aug/23 13:55

Description

Currently admin UI looks for implicit grant type in solr 8.8.2 version. Since implicit grant/flow is deprecated in OAuth 2.1 draft we should consider Authorization Code Flow.

Consider the IETF draft titled "OAuth 2.0 for Browser-Based Apps", which has this justification for the changed recommendation:

There are several drawbacks to the implicit flow, generally involving vulnerabilities associated with the exposure of the access token in the URL. See Section 9.8 for an analysis of these attacks and the drawbacks of using the implicit flow in browsers. [...]

In recent years, widespread adoption of Cross-Origin Resource Sharing (CORS), which enables exceptions to the same-origin policy, allows browser-based apps to use the OAuth 2.0 authorization code flow and make a POST request to exchange the authorization code for an access token at the token endpoint. In this flow, the access token is never exposed in the less secure front-channel. Furthermore, adding PKCE to the flow ensures that even if an authorization code is intercepted, it is unusable by an attacker.

For this reason, and from other lessons learned, the current best practice for browser-based applications is to use the OAuth 2.0 authorization code flow with PKCE.

Issue Links

• duplicates: SOLR-16896 add support of OAuth 2.0/OIDC 'code with PKCE' flow (front-end)