Valid authorization tokens rejected in version 0.5.4 and above

I am experiencing what I believe to be a bug when upgrading from version 0.5.3 to 0.5.4.

I am trying to test a backend app that receives requests from a frontend app. I am using version 2.1.7 of token-support to set up token validation. The code I am using to mock the authentication looks something like

private val mockOAuth2Server = MockOAuth2Server()

fun mockAuthToken(): String =
    mockOAuth2Server.issueToken(
        issuerId = "mockIssuer", // not the actual value used
        subject = "mockSubject",
        audience = "aud-localhost",
        claims = mapOf(
            "pid" to "mockPid"
        )
    )
        .serialize()

When using 0.5.3, my tests are completing as expected. In short, requests are made to a mocked app which either responds 200 OK or 401 Unauthorized, depending on the content of the “Authorization”-header of the request. When using 0.5.4, all requests return 401 Unauthorized.

I’m not entirely sure what causes the bug, but I’ve been able to pinpoint a piece of code which differs in behaviour when using the different versions. The code that behaves differently can be found here.

I’ll try to explain the issue I’m experiencing based on the code referred to above. Using 0.5.3 of mock-oauth2-server, when using a valid authorization token, jwtToken.getIssuer() evaluates to "http://view-localhost:<port>/<issuer>", and config.issuers, which the config.getIssuer(...) accesses, contains "<issuer>" and "http://view-localhost:<port>/<issuer>". Changing to version 0.5.4, and with no other changes, config.issuers is different. It now contains "<issuer>" (identical) and "http://localhost:<port>/<issuer>" (missing the “view-”-part). This leads the filter-predicate to evaluate to false, and the JWT to be considered invalid and the request to be unauthorized.

That’s pretty much what I’ve been able to figure out so far. I’ll be happy to provide any more information if the issue is unclear in any way.

[bjerga]

@ybelMekk Host-header is not set explicitly and it does not seem to be present during the request. However, when I set a breakpoint at https://github.com/tanettrimas/mock-oauth2-server/blob/master/src/main/kotlin/no/nav/security/mock/oauth2/http/OAuth2HttpRequest.kt#L142, hostheader has value <issuer>:<port>, which seems to cause the altered response from fun proxyAwareUrl() between 0.5.3 and 0.5.4.

[joakibj]

We have the same issue with token-support:2.1.5 and higher (includes mock-oauth2-server:0.5.4). Looks like the iss claim uses an entry in the Windows IP to host mapping C:\Windows\System32\drivers\etc\hosts (e.g. view-localhost) instead of defaulting to the DNS name localhost for 127.0.0.1

This fails locally on Windows but not on CI (Jenkins on Linux)