fix: improve handling of assets data stored in cache

[jgomer2001]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #9297

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The GitHub Pull Request covers various updates and improvements to the authentication-related functionality of the Jans Casa application, focusing on enhancing security, reliability, and user experience through input validation, credential management, error handling, caching mechanisms, and adherence to security best practices.

Expand for full summary

Summary:

The code changes in this GitHub Pull Request cover various updates and improvements to the authentication-related functionality of the Jans Casa application. The changes span multiple files and address different aspects of the application's security, including input validation, error handling, credential management, and caching mechanisms.

Overall, the changes appear to be focused on enhancing the security and reliability of the authentication flows, while also improving the user experience. The key security-related observations include:

1. Proper input validation and sanitization to prevent potential injection vulnerabilities (e.g., SQL injection, command injection).
2. Secure handling of user credentials, FIDO2 assertions, and one-time passwords (OTPs).
3. Robust error handling and logging to provide meaningful feedback to users and facilitate incident response.
4. Caching mechanisms to improve performance, with considerations for cache poisoning and data sensitivity.
5. Adherence to security best practices, such as rate-limiting, account lockout, and secure communication.

The changes also include updates to the documentation, which provide guidance on integrating custom authentication methods and highlight important security-related design decisions.

Overall, the code changes appear to be well-considered from a security perspective, and the application seems to be making efforts to implement secure authentication functionality. However, it is essential to continue reviewing the entire codebase, testing the application's security posture, and monitoring for any potential vulnerabilities or misconfigurations.

Files Changed:

1. io.jans.casa.authn.fido2.flow: Updates the class name for the FIDO2 authentication flow, with security considerations around input validation, credential handling, and secure communication.
2. io.jans.casa.authn.otp.flow: Improvements to the one-time password (OTP) authentication flow, including input validation, error handling, and credential management.
3. io.jans.casa.authn.main.flow: Updates to the main authentication flow, focusing on error handling, trusted device management, and two-factor authentication (2FA) integration.
4. docs/casa/developer/add-authn-methods.md: Documentation updates on integrating custom authentication methods, emphasizing security best practices.
5. io.jans.casa.authn.CasaConfig: Changes to the caching mechanism for UI parameters, with considerations for cache fallback and secure data handling.
6. io.jans.casa.authn.MFAInfoHelper: Minor update to the import statement for the CasaWSBase class.
7. io.jans.casa.authn.twilio_sms.flow: Updates to the SMS-based two-factor authentication (2FA) flow, including error message improvements.
8. io.jans.casa.authn.UserAuthnUtil: Changes to the user authentication utility, focusing on policy handling and trusted device management.
9. selector.ftlh: Improvements to the error message handling in the authentication method selector page.
10. io.jans.casa.authn.OTPSmsSender: Updates to the OTP SMS sender functionality, with considerations for input validation and secure phone number handling.
11. io.jans.casa.core.AssetsService: Changes to the assets cache management, with potential security implications around cached data sensitivity and cache poisoning attacks.
12. com.acme.authn.color.flow: Updates to the color validation flow, including improved error handling and retry mechanism.

Code Analysis

We ran 9 analyzers against 15 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	4 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.