From: Wolfgang Bumiller <w.bumiller@proxmox.com>
To: Mira Limbeck <m.limbeck@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Subject: [pve-devel] applied: [PATCH access-control] fix #4074: increase API OpenID code size limit to 2048
Date: Thu, 23 Jun 2022 11:46:03 +0200 [thread overview]
Message-ID: <20220623094603.fbutixu5sh4dss4f@casey.proxmox.com> (raw)
In-Reply-To: <20220615140950.2586849-1-m.limbeck@proxmox.com>
applied, but bumped to 4k, while I think that's *massive*, it'll be even
less likely to be hit, I hope :-)
On Wed, Jun 15, 2022 at 04:09:50PM +0200, Mira Limbeck wrote:
> Azure AD seems to have a variable authorization code size, depending on
> the browser state according to one report in bug #4074 [0].
>
> Sometimes the size is greater than our current limit of 1024, so
> increase it to 2048.
>
> The RFC [1] mentions that there is no limit to the code size, but based on
> current experience, a size limit of 2048 might be enough for every
> current OpenID Connect provider.
>
> [0] https://bugzilla.proxmox.com/show_bug.cgi?id=4074
> [1] https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
>
> Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
> ---
> The PBS implementation doesn't seem to be using any code size limit, do
> we want to remove it entirely in PVE as well?
>
> src/PVE/API2/OpenId.pm | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
> index c838b2c..8653d61 100644
> --- a/src/PVE/API2/OpenId.pm
> +++ b/src/PVE/API2/OpenId.pm
> @@ -134,7 +134,7 @@ __PACKAGE__->register_method ({
> code => {
> description => "OpenId authorization code.",
> type => 'string',
> - maxLength => 1024,
> + maxLength => 2048,
> },
> 'redirect-url' => {
> description => "Redirection Url. The client should set this to the used server url (location.origin).",
> --
> 2.30.2
prev parent reply other threads:[~2022-06-23 9:46 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-15 14:09 [pve-devel] " Mira Limbeck
2022-06-17 8:42 ` Wolfgang Bumiller
2022-06-20 9:11 ` Mira Limbeck
2022-06-23 9:46 ` Wolfgang Bumiller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220623094603.fbutixu5sh4dss4f@casey.proxmox.com \
--to=w.bumiller@proxmox.com \
--cc=m.limbeck@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox