Skip JwtToken validation for mobile app #79
Conversation
|
""" WalkthroughTwo new configuration properties for enabling or disabling Springdoc OpenAPI and Swagger UI are introduced in the CI properties file, both controlled by an environment variable. In the JWT user ID validation filter, requests from mobile clients are now detected via the User-Agent header and bypass JWT validation, and requests without JWT tokens are allowed to proceed only if from recognized mobile clients with authorization headers; otherwise, unauthorized requests receive a 401 response. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant JwtUserIdValidationFilter
participant Application
Client->>JwtUserIdValidationFilter: Sends HTTP request
JwtUserIdValidationFilter->>JwtUserIdValidationFilter: Check if path should be skipped
alt Path skipped
JwtUserIdValidationFilter->>Application: Pass request
else
JwtUserIdValidationFilter->>JwtUserIdValidationFilter: Retrieve JWT from cookie
JwtUserIdValidationFilter->>JwtUserIdValidationFilter: Validate JWT from cookie
alt Valid cookie JWT
JwtUserIdValidationFilter->>Application: Pass request
else
JwtUserIdValidationFilter->>JwtUserIdValidationFilter: Retrieve JWT from header
JwtUserIdValidationFilter->>JwtUserIdValidationFilter: Validate JWT from header
alt Valid header JWT
JwtUserIdValidationFilter->>Application: Pass request
else
JwtUserIdValidationFilter->>JwtUserIdValidationFilter: Check User-Agent for mobile client and Authorization header
alt Mobile client with Authorization header
JwtUserIdValidationFilter->>Application: Pass request
else
JwtUserIdValidationFilter->>Client: Respond 401 Unauthorized
end
end
end
end
Poem
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java (1)
37-96: Architectural concern: Authentication bypass impacts overall security modelThe changes to bypass authentication for mobile clients and allow requests without JWT tokens fundamentally weaken the security architecture. The combination of these two changes means that any client can:
- Spoof a mobile User-Agent to bypass JWT validation
- Even without spoofing, proceed through the filter chain without a valid token
These changes should be thoroughly reviewed with your security team before implementation.
Consider the following alternatives:
- Implement a dedicated authentication filter for mobile clients that uses appropriate security measures
- Use a different authentication scheme for mobile (e.g., OAuth2 with refresh tokens)
- If JWT is problematic for mobile, address the specific issues rather than bypassing authentication entirely
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (2)
src/main/environment/common_ci.properties(1 hunks)src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Analyze (java)
🔇 Additional comments (1)
src/main/environment/common_ci.properties (1)
117-118: Added Springdoc configuration for API documentationThese new properties control the visibility of OpenAPI documentation and Swagger UI, both tied to the same environment variable
SWAGGER_DOC_ENABLED. This is a good practice for toggling documentation visibility in different environments.
| private boolean isMobileClient(String userAgent) { | ||
| if (userAgent == null) return false; | ||
| userAgent = userAgent.toLowerCase(); | ||
| // Common indicators for mobile apps | ||
| return userAgent.contains("okhttp") || // Android OkHttp client | ||
| userAgent.contains("android") || // Generic Android apps | ||
| userAgent.contains("dalvik") || // Android runtime | ||
| userAgent.contains("iphone") || // iOS device | ||
| userAgent.contains("ios"); // Custom iOS client | ||
| } |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Security concern: Mobile client detection may be insufficient
The isMobileClient implementation relies on common user agent string patterns which can be easily spoofed. This approach doesn't provide strong guarantees about the client's authenticity.
If bypassing JWT validation for mobile clients is a requirement, consider implementing a more robust authentication mechanism specific to mobile clients, such as:
- API keys with additional verification
- Client certificates
- Mobile-specific tokens with proper validation
🏁 Script executed:
#!/bin/bash
# Check if there are any existing security measures for mobile clients
grep -r "mobile.*auth" --include="*.java" .Length of output: 45
Strengthen mobile client authentication
Relying solely on user-agent strings in isMobileClient (e.g. checking for “okhttp”, “android”, “iphone”) is easily spoofed and effectively allows any client that sets those headers to bypass JWT validation. To prevent unauthorized access:
• File: src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java (lines 118–127)
– The UA‐based check should not trigger a bypass of your primary authentication.
• Replace or complement it with a stronger mechanism, for example:
- Issue and validate mobile‐specific API keys or tokens with HMAC signing
- Enforce client certificates (mTLS) for trusted mobile apps
- Use a mobile SDK to securely store and rotate credentials (e.g., OAuth2 with PKCE)
🤖 Prompt for AI Agents
In src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java around
lines 118 to 127, the current isMobileClient method relies solely on user-agent
string checks, which are easily spoofed and insecure for bypassing JWT
validation. To fix this, remove or disable the user-agent based bypass and
implement a stronger authentication mechanism for mobile clients, such as
validating mobile-specific API keys or tokens with HMAC, enforcing client
certificates (mTLS), or integrating OAuth2 with PKCE via a mobile SDK to
securely manage credentials and ensure proper authentication.
| String userAgent = request.getHeader("User-Agent"); | ||
| if (isMobileClient(userAgent)) { | ||
| logger.info("Skipping JWT validation for X-Request-Source : "+userAgent); | ||
| filterChain.doFilter(servletRequest, servletResponse); | ||
| return; | ||
| } |
There was a problem hiding this comment.
Security concern: Bypassing JWT validation for mobile clients
The code now bypasses JWT authentication entirely for mobile clients by checking the User-Agent header, which can be easily spoofed. This creates a significant security vulnerability as any request can claim to be from a mobile client.
Consider implementing a more secure authentication mechanism for mobile clients, such as:
- Using a different authentication token specifically for mobile clients
- Implementing app-specific signatures that can't be easily spoofed
- Adding additional validation steps for mobile clients
- if (isMobileClient(userAgent)) {
- logger.info("Skipping JWT validation for X-Request-Source : "+userAgent);
- filterChain.doFilter(servletRequest, servletResponse);
- return;
- }
+ // If mobile client, use alternative authentication
+ if (isMobileClient(userAgent)) {
+ logger.info("Mobile client detected, applying mobile authentication: "+userAgent);
+ // Validate mobile-specific authentication mechanism
+ if (!validateMobileAuthentication(request)) {
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid mobile authentication");
+ return;
+ }
+ filterChain.doFilter(servletRequest, servletResponse);
+ return;
+ }Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java around
lines 37 to 42, the current code bypasses JWT validation based on the User-Agent
header, which is insecure due to easy spoofing. Remove the bypass logic that
skips JWT validation for mobile clients. Instead, implement a secure
authentication mechanism for mobile clients, such as requiring a separate
authentication token, verifying app-specific signatures, or adding additional
validation steps before allowing the request to proceed.
src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java
Outdated
Show resolved
Hide resolved
|
|
2 participants
📋 Description
JIRA ID: AMM-1456
Please provide a summary of the change and the motivation behind it. Include relevant context and details.
✅ Type of Change
ℹ️ Additional Information
Please describe how the changes were tested, and include any relevant screenshots, logs, or other information that provides additional context.
Summary by CodeRabbit
New Features
Bug Fixes