🔒️(backend) secure native app OIDC login with exchange codes

Add one-time exchange code mechanism for native app OIDC login.
Instead of exposing session ID in redirect URL, generates a
short-lived single-use code stored in Redis. Native apps exchange
this code for the session ID via a dedicated API endpoint.

Includes NativeAppRedirect for custom URL schemes, rate limiting,
logging, and whitelist of allowed schemes.

Closes #1153

Co-Authored-By: gigi206

.github/workflows/docker-hub.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 env:
   DOCKER_USER: 1001:127
   DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
@@ -20,6 +23,8 @@ env:
 jobs:
   build-and-push-backend:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -63,6 +68,8 @@ jobs:
 
   build-and-push-frontend-generic:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -107,6 +114,8 @@ jobs:
 
   build-and-push-frontend-dinum:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -151,6 +160,8 @@ jobs:
 
   build-and-push-summary:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -197,6 +208,8 @@ jobs:
 
   build-and-push-agents:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -242,6 +255,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
   notify-argocd:
+    permissions:
+      contents: read
     needs:
       - build-and-push-frontend-generic
       - build-and-push-frontend-dinum

CHANGELOG.md

@@ -28,6 +28,7 @@ and this project adheres to
 - ♻️(backend) align Application model field with `is_active` convention #1133
 - 🔐(backend) avoids revealing the inactive status of an application #1135
 - ⚡️(helm) reduce initialDelaySeconds and add periods seconds #1139
+- 🔒️(backend) avoid information exposure through exception messages #1144
 
 ### Fixed
 

src/backend/core/api/throttling.py

@@ -73,3 +73,9 @@ class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
     """Throttle Anonymous user requesting room generation callback"""
 
     scope = "creation_callback"
+
+
+class SessionExchangeAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle anonymous requests to the session exchange endpoint."""
+
+    scope = "session_exchange"

src/backend/core/api/viewsets.py

@@ -488,9 +488,7 @@ class RoomViewSet(
             if status_code == drf_status.HTTP_500_INTERNAL_SERVER_ERROR:
                 raise e
 
-            return drf_response.Response(
-                {"status": "error", "message": str(e)}, status=status_code
-            )
+            return drf_response.Response({"status": "error"}, status=status_code)
 
     @decorators.action(
         detail=False,
@@ -757,10 +755,10 @@ class RecordingViewSet(
             recording_id = parser.get_recording_id(request.data)
 
         except ParsingEventDataError as e:
-            raise drf_exceptions.PermissionDenied(f"Invalid request data: {e}") from e
+            raise drf_exceptions.PermissionDenied("Invalid request data.") from e
 
         except InvalidBucketError as e:
-            raise drf_exceptions.PermissionDenied("Invalid bucket specified") from e
+            raise drf_exceptions.PermissionDenied("Invalid bucket specified.") from e
 
         except InvalidFilepathError:
             return drf_response.Response(

src/backend/core/authentication/api.py

@@ -0,0 +1,61 @@
+"""API endpoint for exchanging a one-time code for a session ID."""
+
+import logging
+
+from django.conf import settings
+from django.core.cache import cache
+
+from rest_framework import serializers, status
+from rest_framework.decorators import api_view, permission_classes, throttle_classes
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+
+from core.api.throttling import SessionExchangeAnonRateThrottle
+
+from .views import EXCHANGE_CODE_PREFIX
+
+logger = logging.getLogger(__name__)
+
+
+class SessionExchangeSerializer(serializers.Serializer):
+    """Validates the exchange code request."""
+
+    code = serializers.CharField(max_length=64, min_length=16)
+
+
+@api_view(["POST"])
+@permission_classes([AllowAny])
+@throttle_classes([SessionExchangeAnonRateThrottle])
+def session_exchange(
+    request,
+):  # NOSONAR (S3752) POST-only, AllowAny is intentional: single-use code with 30s TTL and rate limiting
+    """Exchange a one-time code for a session ID.
+
+    The code was generated during the OIDC callback and stored in cache
+    with a short TTL. This endpoint retrieves the session ID, deletes the
+    code (single-use), and returns the session ID to the native app.
+    """
+    serializer = SessionExchangeSerializer(data=request.data)
+    serializer.is_valid(raise_exception=True)
+
+    code = serializer.validated_data["code"]
+    cache_key = f"{EXCHANGE_CODE_PREFIX}{code}"
+
+    session_key = cache.get(cache_key)
+    if session_key is None:
+        logger.warning(
+            "Session exchange failed: invalid or expired code from %s",
+            request.META.get("REMOTE_ADDR"),
+        )
+        return Response(
+            {"detail": "Invalid or expired code."},
+            status=status.HTTP_400_BAD_REQUEST,
+        )
+
+    # Delete immediately — single use
+    cache.delete(cache_key)
+
+    cookie_name = getattr(settings, "SESSION_COOKIE_NAME", "sessionid")
+    logger.info("Session exchange successful from %s", request.META.get("REMOTE_ADDR"))
+
+    return Response({cookie_name: session_key})

src/backend/core/authentication/views.py

@@ -0,0 +1,103 @@
+"""Custom OIDC authentication views for native app support.
+
+When a native app (iOS, Android, Desktop) initiates OIDC login, it sets
+`returnTo` to a custom URL scheme (e.g. `visio://auth-callback`). After
+the OIDC flow completes, Django sets the session cookie and redirects to
+that URL. However, native apps cannot read browser cookies — they need
+the session ID passed explicitly.
+
+Instead of exposing the session ID directly in the redirect URL, this
+module generates a short-lived, single-use exchange code. The native app
+then exchanges this code for the session ID via a dedicated API endpoint.
+"""
+
+import uuid
+from urllib.parse import urlencode, urlparse
+
+from django.conf import settings
+from django.core.cache import cache
+from django.http import HttpResponseRedirect
+
+from lasuite.oidc_login.views import (
+    OIDCAuthenticationCallbackView as BaseCallbackView,
+    OIDCAuthenticationRequestView as BaseRequestView,
+)
+
+# Cache key prefix and TTL for exchange codes
+EXCHANGE_CODE_PREFIX = "auth_exchange:"
+EXCHANGE_CODE_TTL = 30  # seconds
+
+
+class NativeAppRedirect(HttpResponseRedirect):
+    """HttpResponseRedirect subclass that allows native app custom URL schemes.
+
+    Django's HttpResponseRedirect only allows http, https, and ftp schemes.
+    Native apps use custom schemes (e.g. visio://) for deep links, which
+    Django rejects with DisallowedRedirect. This subclass extends
+    allowed_schemes with the configured native app schemes.
+    """
+
+    allowed_schemes = HttpResponseRedirect.allowed_schemes + list(
+        getattr(settings, "NATIVE_APP_REDIRECT_SCHEMES", [])
+    )
+
+
+class OIDCAuthenticationRequestView(BaseRequestView):
+    """Custom authenticate view that preserves native app returnTo in session.
+
+    mozilla-django-oidc's get_next_url() rejects custom URL schemes
+    (e.g. visio://auth-callback) because url_has_allowed_host_and_scheme()
+    only allows http/https. We intercept the returnTo parameter and store
+    it directly in the session for whitelisted schemes, bypassing the
+    safety check (which is not relevant for native app deep links).
+    """
+
+    def get(self, request):
+        redirect_field = getattr(settings, "OIDC_REDIRECT_FIELD_NAME", "returnTo")
+        return_to = request.GET.get(redirect_field, "")
+        parsed = urlparse(return_to)
+        allowed_schemes = getattr(settings, "NATIVE_APP_REDIRECT_SCHEMES", [])
+
+        response = super().get(request)
+
+        # Override oidc_login_next AFTER super() which set it to None
+        # via get_next_url() rejecting the custom scheme.
+        if parsed.scheme in allowed_schemes:
+            request.session["oidc_login_next"] = return_to
+            request.session.save()
+
+        return response
+
+
+class OIDCAuthenticationCallbackView(BaseCallbackView):
+    """Callback view that generates an exchange code for native app deep links."""
+
+    def login_success(self):
+        """After successful login, append exchange code for whitelisted scheme redirects."""
+        # Temporarily remove native redirect from session to prevent
+        # super().login_success() from raising DisallowedRedirect when
+        # it tries HttpResponseRedirect with a custom scheme.
+        native_redirect = self.request.session.pop("oidc_login_next", None)
+        allowed_schemes = getattr(settings, "NATIVE_APP_REDIRECT_SCHEMES", [])
+        parsed = urlparse(native_redirect or "")
+
+        if native_redirect and parsed.scheme in allowed_schemes:
+            # Let super() redirect to the default URL (homepage)
+            super().login_success()
+
+            # Generate a short-lived, single-use exchange code
+            exchange_code = uuid.uuid4().hex
+            session_key = self.request.session.session_key
+            cache.set(
+                f"{EXCHANGE_CODE_PREFIX}{exchange_code}",
+                session_key,
+                EXCHANGE_CODE_TTL,
+            )
+
+            separator = "&" if parsed.query else "?"
+            new_url = (
+                f"{native_redirect}{separator}{urlencode({'code': exchange_code})}"
+            )
+            return NativeAppRedirect(new_url)
+
+        return super().login_success()

src/backend/core/enums.py

@@ -14,7 +14,7 @@ FILE_EXT_REGEX = r"[a-zA-Z0-9]{1,10}"
 
 # pylint: disable=line-too-long
 RECORDING_STORAGE_URL_PATTERN = re.compile(
-    f"{settings.MEDIA_URL:s}{settings.RECORDING_OUTPUT_FOLDER}/(?P<recording_id>{UUID_REGEX:s})\.(?P<extension>{FILE_EXT_REGEX:s})"
+    rf"{settings.MEDIA_URL:s}{settings.RECORDING_OUTPUT_FOLDER}/(?P<recording_id>{UUID_REGEX:s})\.(?P<extension>{FILE_EXT_REGEX:s})"
 )
 
 MEDIA_STORAGE_URL_PATTERN = re.compile(

src/backend/core/tests/authentication/test_session_exchange.py

@@ -0,0 +1,143 @@
+"""
+Tests for the session exchange API endpoint and OIDC callback view.
+"""
+
+import uuid
+
+from django.core.cache import cache
+
+import pytest
+from rest_framework.test import APIClient
+
+from core.authentication.views import EXCHANGE_CODE_PREFIX, EXCHANGE_CODE_TTL
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture(autouse=True)
+def _clear_throttle_cache():
+    """Clear cache before each test to reset throttle counters."""
+    cache.clear()
+
+
+def test_session_exchange_valid_code():
+    """A valid exchange code should return the session ID and be consumed."""
+    code = uuid.uuid4().hex
+    cache_key = f"{EXCHANGE_CODE_PREFIX}{code}"
+    cache.set(cache_key, "test-session-key-123", EXCHANGE_CODE_TTL)
+
+    client = APIClient()
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": code},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert "test-session-key-123" in data.values()
+
+    # Code should be consumed (single-use)
+    assert cache.get(cache_key) is None
+
+
+def test_session_exchange_invalid_code():
+    """An invalid/unknown code should return 400."""
+    client = APIClient()
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": uuid.uuid4().hex},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid or expired code."
+
+
+def test_session_exchange_expired_code():
+    """An expired code should return 400."""
+    code = uuid.uuid4().hex
+    cache_key = f"{EXCHANGE_CODE_PREFIX}{code}"
+    # Set with 0 TTL to simulate expiration
+    cache.set(cache_key, "expired-session", 0)
+
+    client = APIClient()
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": code},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+def test_session_exchange_code_too_short():
+    """A code that's too short should be rejected by validation."""
+    client = APIClient()
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": "short"},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+def test_session_exchange_missing_code():
+    """Missing code field should be rejected."""
+    client = APIClient()
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+def test_session_exchange_replay_attack():
+    """Using the same code twice should fail the second time."""
+    code = uuid.uuid4().hex
+    cache.set(f"{EXCHANGE_CODE_PREFIX}{code}", "session-123", EXCHANGE_CODE_TTL)
+
+    client = APIClient()
+
+    # First use succeeds
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": code},
+        format="json",
+    )
+    assert response.status_code == 200
+
+    # Second use fails
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": code},
+        format="json",
+    )
+    assert response.status_code == 400
+
+
+def test_session_exchange_returns_correct_cookie_name(settings):
+    """The response key should match SESSION_COOKIE_NAME from settings."""
+    settings.SESSION_COOKIE_NAME = "meet_sessionid"
+    code = uuid.uuid4().hex
+    cache.set(f"{EXCHANGE_CODE_PREFIX}{code}", "my-session", EXCHANGE_CODE_TTL)
+
+    client = APIClient()
+    response = client.post(
+        "/api/v1.0/auth/session-exchange/",
+        {"code": code},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"meet_sessionid": "my-session"}
+
+
+def test_session_exchange_get_not_allowed():
+    """GET method should not be allowed on the exchange endpoint."""
+    client = APIClient()
+    response = client.get("/api/v1.0/auth/session-exchange/")
+    assert response.status_code == 405

src/backend/core/tests/recording/test_api_recordings_storage_hook.py

@@ -95,7 +95,7 @@ def test_save_recording_parsing_error(recording_settings, mock_get_parser, clien
     )
 
     assert response.status_code == 403
-    assert response.json() == {"detail": "Invalid request data: Error message"}
+    assert response.json() == {"detail": "Invalid request data."}
 
 
 def test_save_recording_bucket_error(recording_settings, mock_get_parser, client):
@@ -112,7 +112,7 @@ def test_save_recording_bucket_error(recording_settings, mock_get_parser, client
     )
 
     assert response.status_code == 403
-    assert response.json() == {"detail": "Invalid bucket specified"}
+    assert response.json() == {"detail": "Invalid bucket specified."}
 
 
 def test_save_recording_filetype_error(recording_settings, mock_get_parser):

src/backend/core/tests/rooms/test_api_rooms_webhook.py

@@ -77,7 +77,6 @@ def test_missing_auth_header(client, serialized_event_data, mock_livekit_config)
     assert response.status_code == 401
     assert response.json() == {
         "status": "error",
-        "message": "Authorization header missing",
     }
 
 
@@ -91,7 +90,7 @@ def test_invalid_payload(client, auth_token, mock_livekit_config):
     )
 
     assert response.status_code == 400
-    assert response.json() == {"status": "error", "message": "Invalid webhook payload"}
+    assert response.json() == {"status": "error"}
 
 
 def test_unknown_event_type(client, mock_livekit_config):
@@ -116,7 +115,6 @@ def test_unknown_event_type(client, mock_livekit_config):
     assert response.status_code == 422
     assert response.json() == {
         "status": "error",
-        "message": "Unknown webhook type: unknown_event_type",
     }
 
 

src/backend/core/urls.py

@@ -7,6 +7,7 @@ from lasuite.oidc_login.urls import urlpatterns as oidc_urls
 from rest_framework.routers import DefaultRouter
 
 from core.api import get_frontend_configuration, viewsets
+from core.authentication.api import session_exchange
 from core.external_api import viewsets as external_viewsets
 
 # - Main endpoints
@@ -40,6 +41,9 @@ urlpatterns = [
             [
                 *router.urls,
                 *oidc_urls,
+                path(
+                    "auth/session-exchange/", session_exchange, name="session_exchange"
+                ),
                 path("config/", get_frontend_configuration, name="config"),
             ]
         ),

src/backend/meet/settings.py

@@ -344,6 +344,11 @@ class Base(Configuration):
                 environ_name="CREATION_CALLBACK_THROTTLE_RATES",
                 environ_prefix=None,
             ),
+            "session_exchange": values.Value(
+                default="5/minute",
+                environ_name="SESSION_EXCHANGE_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
         },
     }
     MONITORED_THROTTLE_FAILURE_CALLBACK = (
@@ -459,8 +464,16 @@ class Base(Configuration):
     )
 
     # OIDC - Authorization Code Flow
-    OIDC_AUTHENTICATE_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationRequestView"
-    OIDC_CALLBACK_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationCallbackView"
+    OIDC_AUTHENTICATE_CLASS = "core.authentication.views.OIDCAuthenticationRequestView"
+    OIDC_CALLBACK_CLASS = "core.authentication.views.OIDCAuthenticationCallbackView"
+
+    # Custom URL schemes allowed for native app OIDC redirects.
+    # Only these schemes will receive an exchange code in the callback.
+    NATIVE_APP_REDIRECT_SCHEMES = values.ListValue(
+        default=["visio"],
+        environ_name="NATIVE_APP_REDIRECT_SCHEMES",
+        environ_prefix=None,
+    )
     OIDC_CREATE_USER = values.BooleanValue(
         default=True, environ_name="OIDC_CREATE_USER", environ_prefix=None
     )