From c9d9a7788c02bbbf49b50a8be501087391c60854 Mon Sep 17 00:00:00 2001 From: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> Date: Fri, 31 Jul 2026 14:37:19 -0500 Subject: [PATCH 1/2] docs: Correct what _validate_token claims to do The method is named validate, its docstring says it validates the token against the OAuth2 server, and the caller logs 'Token successfully validated' afterwards. None of that holds: the bearer scheme only parses an Authorization header, and the method builds that header itself, so every token value passes including the empty string. The token is really verified in _decode_token. Anyone auditing the auth path is misled into thinking a verification step happens here. Describe what the call actually checks (that the discovery document exposes the OAuth2 endpoints) and log that instead. No behavior change: docstring and log message only. Whether the call should exist at all is asked separately in #6688. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --- .../feast/permissions/auth/oidc_token_parser.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/sdk/python/feast/permissions/auth/oidc_token_parser.py b/sdk/python/feast/permissions/auth/oidc_token_parser.py index c02ec2b81ef..85bcb76761c 100644 --- a/sdk/python/feast/permissions/auth/oidc_token_parser.py +++ b/sdk/python/feast/permissions/auth/oidc_token_parser.py @@ -43,8 +43,17 @@ def __init__(self, auth_config: OidcAuthConfig): self._k8s_auth_api = None async def _validate_token(self, access_token: str): - """ - Validate the token extracted from the header of the user request against the OAuth2 server. + """Check that the provider's discovery document exposes the OAuth2 endpoints. + + This does **not** verify *access_token*, despite taking it: the bearer + scheme below only parses an ``Authorization`` header, and this method + supplies that header itself, so any token value passes. The token is + genuinely verified in ``_decode_token``, which checks the signature + against the provider's JWKS and validates the claims. + + What can fail here is constructing the scheme, which reads the token + and authorization endpoints from the discovery document. A document + missing either one raises before any token is inspected. """ # FastAPI's OAuth2AuthorizationCodeBearer requires a Request type but actually uses only the headers field # https://github.com/tiangolo/fastapi/blob/eca465f4c96acc5f6a22e92fd2211675ca8a20c8/fastapi/security/oauth2.py#L380 @@ -198,7 +207,7 @@ async def user_details_from_access_token(self, access_token: str) -> User: # Standard OIDC / Keycloak flow try: await self._validate_token(access_token) - logger.debug("Token successfully validated.") + logger.debug("OIDC discovery document exposes the expected endpoints.") except Exception as e: if self._is_ssl_error(e): logger.error( From 8d3597be8776e36626339f2874eb31ec9eaca6dc Mon Sep 17 00:00:00 2001 From: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> Date: Wed, 5 Aug 2026 07:21:00 -0500 Subject: [PATCH 2/2] refactor: Rename _validate_token to _check_discovery_endpoints The method never verified the token it takes: it builds a bearer scheme whose header it supplies itself, so any token value passes. What it does check is that the discovery document exposes the OAuth2 endpoints, which is what the docstring already said after the previous commit. Leaving the old name meant the docstring had to spend its opening correcting the name. Private method, single caller in the same file, so the rename is contained. The access_token parameter stays: the bearer scheme requires a well-formed Authorization header, and the caller has the token to hand. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --- sdk/python/feast/permissions/auth/oidc_token_parser.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk/python/feast/permissions/auth/oidc_token_parser.py b/sdk/python/feast/permissions/auth/oidc_token_parser.py index adeb970f09f..91669e66647 100644 --- a/sdk/python/feast/permissions/auth/oidc_token_parser.py +++ b/sdk/python/feast/permissions/auth/oidc_token_parser.py @@ -77,7 +77,7 @@ def _get_jwks_client(self) -> PyJWKClient: ) return self._jwks_client - async def _validate_token(self, access_token: str): + async def _check_discovery_endpoints(self, access_token: str): """Check that the provider's discovery document exposes the OAuth2 endpoints. This does **not** verify *access_token*, despite taking it: the bearer @@ -227,7 +227,7 @@ async def user_details_from_access_token(self, access_token: str) -> User: # Standard OIDC / Keycloak flow try: - await self._validate_token(access_token) + await self._check_discovery_endpoints(access_token) logger.debug("OIDC discovery document exposes the expected endpoints.") except Exception as e: if self._is_ssl_error(e):