On Expiration, Auth Navigation not happing inside IFrame

[brandonk10]

I'm using 2.4.11.3, and am noticing a 401 returned on a page located inside an iframe. The IFrame I'm using in the latest Chrome is sending Sec-Fetch-Mode: navigate and Sec-Fetch-Dest: iframe. Taking a look at oidc_is_auth_capable_request, it looks like it's trying to allow the "navigate" option, but(and I might be misreading the code), it looks like this will always return FALSE, because it's checking for both the navigate option and the document option without an else block and only one or the other can be set in a given request. Can you let me know if I read this right?

[brandonk10]

Apologies, I did misread it. It's explicitly trying to block navigate. Is IFrame redirect for auth not allowed in spec?

[brandonk10]

I really should have my coffee before writing. The following change enables auth to occur in an IFrame. I do think this was the original intent of the code, though I might be wrong.

diff --git a/src/mod_auth_openidc.c b/src/mod_auth_openidc.c
index bf5bea4..645f737 100644
--- a/src/mod_auth_openidc.c
+++ b/src/mod_auth_openidc.c
@@ -837,13 +837,9 @@ apr_byte_t oidc_is_auth_capable_request(request_rec *r) {
                        && (apr_strnatcasecmp(oidc_util_hdr_in_x_requested_with_get(r),
                                        OIDC_HTTP_HDR_VAL_XML_HTTP_REQUEST) == 0))
                return FALSE;
-
        if ((oidc_util_hdr_in_sec_fetch_mode_get(r) != NULL)
                        && (apr_strnatcasecmp(oidc_util_hdr_in_sec_fetch_mode_get(r),
-                                                                 OIDC_HTTP_HDR_VAL_NAVIGATE) != 0))
-               return FALSE;
-
-       if ((oidc_util_hdr_in_sec_fetch_dest_get(r) != NULL)
+                                                                 OIDC_HTTP_HDR_VAL_NAVIGATE) != 0)
                        && (apr_strnatcasecmp(oidc_util_hdr_in_sec_fetch_dest_get(r),
                                                                  OIDC_HTTP_HDR_VAL_DOCUMENT) != 0))
                return FALSE;

[zandbelt]

the intent is to block authentication in an iframe by default as it is considered to have security problems; if you want to override that behaviour you can use OIDCUnAuthAction on those path with a specific expression, as described in: https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.11.3/auth_openidc.conf#L842-L849

[brandonk10]

Thank you, I missed the level of detail in Unauth action and can confirm this works as expected. I have CSP set on both the application and IDP sides, so managing the security risk.