merchant

commit 6b9536244a2afa8d634ba9259889f4db9ad6bb2e
parent 385888369d04884a0a95c7299c5825836d96ba70
Author: Christian Grothoff <christian@grothoff.org>
Date:   Sat, 10 Oct 2026 19:42:44 +0200

do not allow instance password as bearer token to bypass MFA

Diffstat:
M
src/backend/taler-merchant-httpd_auth.c
 | 
30
+++++++++++++++++++++++++++++-
M
src/testing/test_merchant_mfa.conf
 | 
1
-

2 files changed, 29 insertions(+), 2 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_auth.c b/src/backend/taler-merchant-httpd_auth.c
@@ -400,6 +400,35 @@ process_bearer_auth (struct TMH_HandlerContext *hc,
                     (int) ec);
         return ec;
       }
+      if (TALER_EC_GENERIC_TOKEN_MALFORMED != ec)
+      {
+        /* The credential is a well-formed login token that is unknown
+           or expired, or the lookup failed: report that, instead of
+           trying to interpret the token as a password. */
+        hc->auth_scope = TMH_AS_NONE;
+        return ec;
+      }
+      {
+        const struct TMH_MerchantInstance *mi = hc->instance;
+        bool have_mfa
+          = ( (NULL != mi->settings.phone) &&
+              (NULL != TMH_helper_sms) &&
+              (mi->settings.phone_validated) ) ||
+            ( (NULL != mi->settings.email) &&
+              (NULL != TMH_helper_email) &&
+              (mi->settings.email_validated) );
+
+        if ( (GNUNET_YES == TMH_strict_v19) ||
+             have_mfa)
+        {
+          /* Passing the password as a bearer token would bypass the
+             second factor required by POST /private/token. */
+          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                      "Refusing deprecated secret-token:password API authN\n");
+          hc->auth_scope = TMH_AS_NONE;
+          return ec;
+        }
+      }
       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                   "Trying deprecated secret-token:password API authN\n");
       token = authn_s + strlen (RFC_8959_PREFIX);
@@ -675,7 +704,6 @@ TMH_perform_access_control (struct TMH_HandlerContext *hc)
   auth = MHD_lookup_connection_value (hc->connection,
                                       MHD_HEADER_KIND,
                                       MHD_HTTP_HEADER_AUTHORIZATION);
-
   if (NULL != auth)
   {
     extract_auth (&auth,
diff --git a/src/testing/test_merchant_mfa.conf b/src/testing/test_merchant_mfa.conf
@@ -13,7 +13,6 @@ DISABLED = YES
 PORT = 9966
 SERVE = tcp
 DB = postgres
-
 HELPER_SMS = ./test_sms_helper.sh
 HELPER_EMAIL = ./test_email_helper.sh
 MANDATORY_TAN_CHANNELS = sms email