From 7da99f2116372b2ad549cae6674a604c7db19cb4 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Wed, 11 Mar 2026 16:52:29 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=90(backend)=20avoids=20revealing=20th?= =?UTF-8?q?e=20inactive=20status=20of=20an=20application?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Authenticate the application secret before checking whether the application is inactive. This avoids revealing the inactive status of an application when an incorrect secret is provided, preventing an authentication state oracle and client_id enumeration. --- CHANGELOG.md | 1 + src/backend/core/external_api/viewsets.py | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 418c25f2..e71add44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,7 @@ and this project adheres to - 🌐(frontend) improve German translation #1125 - 🔨(python-env) migrate meet main app to UV #1120 - ♻️(backend) align Application model field with `is_active` convention #1133 +- 🔐(backend) avoids revealing the inactive status of an application #1135 ### Fixed diff --git a/src/backend/core/external_api/viewsets.py b/src/backend/core/external_api/viewsets.py index 530ef9cd..f714cb16 100644 --- a/src/backend/core/external_api/viewsets.py +++ b/src/backend/core/external_api/viewsets.py @@ -61,12 +61,12 @@ class ApplicationViewSet(viewsets.ViewSet): except models.Application.DoesNotExist as e: raise drf_exceptions.AuthenticationFailed("Invalid credentials") from e - if not application.is_active: - raise drf_exceptions.AuthenticationFailed("Application is inactive") - if not check_password(client_secret, application.client_secret): raise drf_exceptions.AuthenticationFailed("Invalid credentials") + if not application.is_active: + raise drf_exceptions.AuthenticationFailed("Application is inactive") + email = serializer.validated_data["scope"] try: validate_email(email)