fix: pass JSON Web Tokens (JWT) as a header rather than as a request parameter by iansergeant42 · Pull Request #4818 · zowe/api-layer

iansergeant42 · 2026-07-15T14:37:06Z

Description

Prior to this change, JWT are passed between components as request parameters. This change moves their passing to the Authorization header.

Linked to # (issue)
Part of the # (epic)

Type of change

Please delete options that are not relevant.

fix: Bug fix (non-breaking change which fixes an issue)

Checklist:

My code follows the style guidelines of this project
PR title conforms to commit message guideline ## Commit Message Structure Guideline
I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
The java tests in the area I was working on leverage @nested annotations
Any dependent changes have been merged and published in downstream modules

For more details about how should the code look like read the Contributing guideline

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Co-authored-by: Andrew Jandacek <andrew.jandacek@broadcom.com> Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

Co-authored-by: Andrew Jandacek <andrew.jandacek@broadcom.com> Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

…/CompoundAuthProvider.java Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

…assed-in-headers

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

…com/zowe/api-layer into reboot/jwt-tokens-passed-in-headers

…assed-in-headers

pavel-jares-bcm · 2026-07-17T11:09:15Z

-    @DeleteMapping(path = "/invalidate/{token}")
-    public Mono<ResponseEntity<Void>> invalidateJwtToken(@PathVariable String token) {
+    @DeleteMapping(path = "/invalidate")
+    public Mono<ResponseEntity<Void>> invalidateJwtToken(ServerHttpRequest request) {


You can use annotation @RequestHeader("Authorization")

Done, and it simplifies the code dramatically.

pavel-jares-bcm · 2026-07-17T11:10:24Z

        given()
        .when()
-            .get(URI.create(basePath + INVALIDATE_JWT_ENDPOINT + "/" + token))
+            .get(URI.create(basePath + INVALIDATE_JWT_ENDPOINT))


given statement should have .header(AUTHORIZATION, "Baerer " + token)

Added .header(AUTHORIZATION, "Bearer " + token)

pavel-jares-bcm · 2026-07-17T11:11:26Z

            .config(SslContext.clientCertApiml)
        .when()
-            .delete(URI.create(basePath + INVALIDATE_JWT_ENDPOINT + "/" + token))
+            .header("Authorization", "Bearer " + token)


please, use instead org.springframework.http.HttpHeaders#AUTHORIZATION, probably not onlyhere

Suggested change

.header("Authorization", "Bearer " + token)

.header(AUTHORIZATION, "Bearer " + token)

richard-salac · 2026-07-17T11:39:14Z

-            var invalidated = authenticationService.invalidateJwtTokenGateway(token, false, app);
+            final var authHeader = request.getHeaders(). getFirst("Authorization");
+            if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+                return Mono.just(ResponseEntity.status(SC_UNAUTHORIZED).build());


The request is auhteticated by x509 and the token is just payload. If it is missing, it id 400 instead of 401.

Changed to SC_BAD_REQUEST

richard-salac · 2026-07-17T11:40:47Z

+                return Mono.just(ResponseEntity.status(SC_UNAUTHORIZED).build());
+            }
+            final var jwtToken = authHeader.substring(7); //Starts with "Bearer "
+            var invalidated = authenticationService.invalidateJwtTokenGateway(jwtToken, false, app);


What if the token is missing?

I've added an isEmpty() check. The token cannot be null at this stage as "Bearer ".substring(7) is empty. I'll add a test for this.

EDIT - use of @RequestHeader("Authorization") means that you see SC_BAD_REQUEST automatically. There's a test for this.

richard-salac · 2026-07-17T11:45:14Z

+        final var authHeader = request.getHeader("Authorization");
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+            return;
+        }
+        final var jwtToken = authHeader.substring(7);


same comments as for the reactive alternative

Largely the same fixes applied.

richard-salac · 2026-07-17T12:12:49Z

forgotten, needs an update:

api-layer/zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/AuthenticationService.java

Line 442 in 32530e4

    
           var url = EurekaUtils.getUrl(instanceInfo) + AuthController.CONTROLLER_PATH + "/invalidate/{}";

richard-salac · 2026-07-17T12:17:48Z

@pavel-jares-bcm
Could we remove the logic from modulith when infinispan is the only supported caching mode?

Currently, there is a discrepancy in modulith that defines api/v1/auth/invalidate endpoint, but also api/v1/auth/invalidate/ in security chain definition and in ModulithAuthentication service. And yet no tests fails as the code is not used anymore and even before we did not test other caching storage modes.

pavel-jares-bcm · 2026-07-17T12:23:33Z

@pavel-jares-bcm Could we remove the logic from modulith when infinispan is the only supported caching mode?

Currently, there is a discrepancy in modulith that defines api/v1/auth/invalidate endpoint, but also api/v1/auth/invalidate/ in security chain definition and in ModulithAuthentication service. And yet no tests fails as the code is not used anymore and even before we did not test other caching storage modes.

This code is valid for the cases when infinispan is not in use. It means in HA when caching storage is one of inMemory, redis, or VSAM. So we should avoid calling this endpoint just in case modulith and infinispan are active.

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

sonarqubecloud · 2026-07-21T08:56:24Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

richard-salac · 2026-07-21T11:53:16Z

+    }
+
+    @Test
+    void whenNoHeader_withCert_then401() {


typo in name 401 -> 400

richard-salac · 2026-07-21T12:03:45Z

+        if (jwtToken.isEmpty()) { //it cannot be null, as "Bearer".substring(7) is empty, not null
+            response.setStatus(SC_BAD_REQUEST);
+            return;


Can we rely on @RequestHeader like in modulith?

richard-salac · 2026-07-21T12:06:12Z

            try {
-                restTemplate.delete(url);
+                HttpHeaders headers = new HttpHeaders();
+                headers.set("Authorization", "Bearer " + jwtToken);


let's use org.apache.http.HttpHeaders.AUTHORIZATION whenever possible, not only in tests

iansergeant and others added 13 commits July 13, 2026 16:03

Initial commit - use a specific rather than a generic message.

7ecd57c

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Merge branch 'v3.x.x' into reboot/specific-message-for-provider-usage

8e8fefa

Apply suggestions from code review

20c0e3c

Co-authored-by: Andrew Jandacek <andrew.jandacek@broadcom.com> Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

Update common-service-core/src/main/resources/core-log-messages.yml

b64e4f8

Co-authored-by: Andrew Jandacek <andrew.jandacek@broadcom.com> Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

Apply suggestion from @iansergeant42

b595bde

Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

Update zaas-service/src/main/java/org/zowe/apiml/zaas/security/config…

e6fd29a

…/CompoundAuthProvider.java Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

Update zaas-service/src/main/java/org/zowe/apiml/zaas/security/config…

ff38151

…/CompoundAuthProvider.java Signed-off-by: iansergeant42 <129340641+iansergeant42@users.noreply.github.com>

Merge branch 'v3.x.x' into reboot/specific-message-for-provider-usage

60dd373

Merge branch 'v3.x.x' into reboot/specific-message-for-provider-usage

b801d89

Merge branch 'v3.x.x' into reboot/specific-message-for-provider-usage

3dedd00

Code review.

21114a1

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Merge remote-tracking branch 'origin/v3.x.x' into reboot/jwt-tokens-p…

25e749e

…assed-in-headers

Initial commit

b504e92

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

pull-request-size Bot added the size/L label Jul 15, 2026

github-actions Bot added the Sensitive Sensitive change that requires peer review label Jul 15, 2026

iansergeant added 3 commits July 15, 2026 16:51

Checkstyle fixes

5ac0eea

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Checkstyle fixes

01272d4

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Failing tests

1b683ca

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

iansergeant42 marked this pull request as ready for review July 15, 2026 15:59

iansergeant42 and others added 4 commits July 15, 2026 17:59

Merge branch 'v3.x.x' into reboot/jwt-tokens-passed-in-headers

64d1179

Test coverage

cfea024

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Merge branch 'reboot/jwt-tokens-passed-in-headers' of https://github.…

0496d8c

…com/zowe/api-layer into reboot/jwt-tokens-passed-in-headers

Merge remote-tracking branch 'origin/v3.x.x' into reboot/jwt-tokens-p…

32530e4

…assed-in-headers

pavel-jares-bcm reviewed Jul 17, 2026

View reviewed changes

richard-salac reviewed Jul 17, 2026

View reviewed changes

iansergeant added 2 commits July 20, 2026 15:38

Code review changes.

00f0066

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Changes to improve coverage

5aa251a

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

iansergeant added 2 commits July 21, 2026 10:07

Checkstyle

ae882a1

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

Checkstyle

9540e6f

Signed-off-by: Ian Sergeant <ian.sergeant@broadcom.com>

richard-salac reviewed Jul 21, 2026

View reviewed changes

	.header("Authorization", "Bearer " + token)
	.header(AUTHORIZATION, "Bearer " + token)

Uh oh!

Conversation

iansergeant42 commented Jul 15, 2026

Description

Type of change

Checklist:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iansergeant42 Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

richard-salac commented Jul 17, 2026

Uh oh!

richard-salac commented Jul 17, 2026

Uh oh!

pavel-jares-bcm commented Jul 17, 2026

Uh oh!

sonarqubecloud Bot commented Jul 21, 2026

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

iansergeant42 Jul 20, 2026 •

edited

Loading