8000 Reject malformed requests in the docker auth endpoint by jimmychakkalakal · Pull Request #53042 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Reject malformed requests in the docker auth endpoint - #53042

Merged
mposolda merged 1 commit into
keycloak:mainfrom
jimmychakkalakal:issues/49009-Malformed-Requests-In-Docker-Endpoint
Oct 2, 2026
Merged

Reject malformed requests in the docker auth endpoint#53042
mposolda merged 1 commit into
keycloak:mainfrom
jimmychakkalakal:issues/49009-Malformed-Requests-In-Docker-Endpoint

Conversation

@jimmychakkalakal
@jimmychakkalakal jimmychakkalakal commented Sep 22, 2026
Copy link
Copy Markdown
Contributor

Reject malformed requests in the docker auth endpoint

Closes #49009

Co-authored-by: Abhishek Supsande abhisheksupsande7@gmail.com

@jimmychakkalakal
8000
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch 7 times, most recently from 500f298 to 94b77cb Compare September 29, 2026 10:39
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch 7 times, most recently from 99199a4 to 681c213 Compare October 1, 2026 09:13
@jimmychakkalakal
jimmychakkalakal marked this pull request as ready for review October 1, 2026 09:13
@jimmychakkalakal
jimmychakkalakal requested a review from a team as a code owner October 1, 2026 09:13
Copilot AI balanced review requested due to automatic review settings October 1, 2026 09:13
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Joined scopes break Docker’s invalid-credentials response path for valid multi-scope requests.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
What changed in this PR

Rejects malformed Docker authorization requests while preserving valid repeated scope parameters.

Changes:

  • Validates parser errors and returns HTTP 400.
  • Aggregates repeated Docker scopes.
  • Adds integration coverage and stabilizes event handling.
File Description
DockerEndpoint.java Normalizes scopes and rejects invalid requests.
DockerEndpointInvalidRequestTest.java Tests malformed and repeated parameters.
DockerClientTest.java Clears residual login events.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread services/src/main/java/org/keycloak/protocol/docker/DockerEndpoint.java Resolved
Copilot AI balanced review requested due to automatic review settings October 1, 2026 11:20
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from 681c213 to cab7ce2 Compare October 1, 2026 11:20
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Repeated scopes cause invalid-credential paths to throw instead of returning HTTP 401.

Review effort: Balanced
Findings: 1 High severity · 1 Medium severity

Open (2)

Comment thread services/src/main/java/org/keycloak/protocol/docker/DockerEndpoint.java Resolved
Copilot AI balanced review requested due to automatic review settings October 1, 2026 14:16
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from cab7ce2 to 28eb6e3 Compare October 1, 2026 14:16
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The focused validation change correctly addresses the reported bypass and includes regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (2)

Copilot AI balanced review requested due to automatic review settings October 1, 2026 14:40
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from 28eb6e3 to d2c38e8 Compare October 1, 2026 14:40
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The focused validation change correctly addresses the reported bypass and includes suitable regression coverage.

Review effort: Balanced
Findings: None

Copilot AI balanced review requested due to automatic review settings October 1, 2026 15:59
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from d2c38e8 to f1b1cfa Compare October 1, 2026 15:59
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Multi-scope requests can fail unexpectedly on invalid credentials, and the reported policy-bypass scenario lacks coverage.

Review effort: Balanced
Findings: 1 High severity · 1 Low severity

Open (2)

Comment thread services/src/main/java/org/keycloak/protocol/docker/DockerEndpoint.java Resolved
Comment thread tests/base/src/test/java/org/keycloak/tests/docker/DockerEndpointInvalidRequestTest.java Resolved
Copilot AI balanced review requested due to automatic review settings October 1, 2026 17:01
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from f1b1cfa to a57d316 Compare October 1, 2026 17:01
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

A malformed repeated scope can reach DockerAccess and cause an HTTP 500 instead of a controlled rejection.

Review effort: Balanced
Findings: 1 High severity

Open (1)
Resolved since last review (2)

Comment thread services/src/main/java/org/keycloak/protocol/docker/DockerEndpoint.java Resolved
Copilot AI balanced review requested due to automatic review settings October 1, 2026 17:37
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from a57d316 to 70b7f3c Compare October 1, 2026 17:37
Copilot AI reviewed Oct 1, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Scope validation rejects the previously supported space-delimited single-parameter form.

Review effort: Balanced
Findings: 1 High severity

Open (1)
Resolved since last review (1)

Comment thread services/src/main/java/org/keycloak/protocol/docker/DockerEndpoint.java Resolved
@jimmychakkalakal @abhishekS14
Reject malformed requests in the docker auth
8675aff 
endpoint

Closes keycloak#49009

Co-authored-by: Abhishek Supsande <abhisheksupsande7@gmail.com>
Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
Copilot AI 10BC8 balanced review requested due to automatic review settings October 2, 2026 09:13
@jimmychakkalakal
jimmychakkalakal force-pushed the issues/49009-Malformed-Requests-In-Docker-Endpoint branch from 70b7f3c to 8675aff Compare October 2, 2026 09:13
Copilot AI reviewed Oct 2, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The validation behavior is correctly implemented and covered by focused integration tests.

Review effort: Balanced
Findings: None

Resolved since last review (1)

graziang
graziang approved these changes Oct 2, 2026
View reviewed changes
@graziang graziang left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jimmychakkalakal thanks!

mposolda
mposolda approved these changes Oct 2, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jimmychakkalakal Thanks!
Approving and merging on behalf of @graziang review.

@mposolda mposolda self-assigned this Oct 2, 2026
@mposolda
mposolda merged commit edb3370 into keycloak:main Oct 2, 2026
97 checks passed
mposolda pushed a commit that referenced this pull request Oct 5, 2026
@jimmychakkalakal @abhishekS14 @mposolda
Reject malformed requests in the docker auth endpoint (#53042)
b5546a6 
Closes #49009

Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
Co-authored-by: Abhishek Supsande <abhisheksupsande7@gmail.com>
(cherry picked from commit edb3370)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@mposolda mposolda mposolda approved these changes
+1 more reviewer
@graziang graziang graziang approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

Labels

team/core-protocols

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

DockerEndpoint does not validate invalidRequestMessage after parsing authorization request

4 participants

@jimmychakkalakal @mposolda @graziang
0