From ea4a1e2dc6093570e4876b9f2a29c6cecc17d6f4 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 26 Aug 2026 17:10:31 +1000 Subject: http-api: T8989: address Copilot review comments - Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed --- src/services/api/rest/libs/token_auth.py | 6 +++--- src/services/api/rest/routers.py | 5 +++-- src/services/vyos-http-api-server | 6 ++++++ 3 files changed, 12 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/services/api/rest/libs/token_auth.py b/src/services/api/rest/libs/token_auth.py index ea0b14a9c..e0710cc20 100644 --- a/src/services/api/rest/libs/token_auth.py +++ b/src/services/api/rest/libs/token_auth.py @@ -46,6 +46,7 @@ def verify_oidc_token(token: str): disc_url = f"{state.oidc_issuer}/.well-known/openid-configuration" with _req.urlopen(disc_url, timeout=10) as r: jwks_uri = _json.loads(r.read())["jwks_uri"] + state.oidc_jwks_uri = jwks_uri jwks_client = PyJWKClient(jwks_uri, cache_keys=True) signing_key = jwks_client.get_signing_key_from_jwt(token) decode_options = {"require": ["exp"]} @@ -60,9 +61,8 @@ def verify_oidc_token(token: str): else: decode_options["verify_aud"] = False payload = jwt.decode(token, signing_key.key, **decode_kwargs) - return payload.get("sub") or payload.get("client_id") or "oidc-client" - except Exception as e: - print(f"OIDC token validation failed: {e}", flush=True) + return payload.get("sub") or payload.get("client_id") + except Exception: return None diff --git a/src/services/api/rest/routers.py b/src/services/api/rest/routers.py index 0f0662327..1808e5a5b 100644 --- a/src/services/api/rest/routers.py +++ b/src/services/api/rest/routers.py @@ -1046,9 +1046,10 @@ def traceroute_op(data: TracerouteModel): @router.post('/token') -def token_op(data: ApiModel): +def token_op(data: ApiModel, x_api_key: Optional[str] = Header(None)): session = SessionState() - key_id = check_auth(session.keys, data.key) + key = data.key or x_api_key + key_id = check_auth(session.keys, key) if not key_id: raise HTTPException(status_code=401, detail='Valid API key is required') return success(generate_token(key_id)) diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server index 64ac57499..6a420f499 100755 --- a/src/services/vyos-http-api-server +++ b/src/services/vyos-http-api-server @@ -182,6 +182,12 @@ def initialization(session: SessionState, app: FastAPI = app): session.keys = flatten_keys(server_config) rest_config = server_config.get('rest', {}) + # Reset REST auth settings on reload so removed config nodes don't persist in-memory + session.rest_token_exp = None + session.rest_secret_len = None + session.oidc_issuer = None + session.oidc_jwks_uri = None + session.oidc_audience = None session.debug = bool('debug' in rest_config) session.strict = bool('strict' in rest_config) if isinstance(rest_config, dict): -- cgit v1.2.3