From 3f4539c4b39e6f302d01025ba641dba38e604614 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Fri, 18 Sep 2026 12:20:51 +0300 Subject: [PATCH 1/2] Load jQuery over https with SRI in the UMA sample pages The UMA sample pages loaded jquery-latest.min.js (frozen at 1.11.1) over plain http and without an integrity check. Pin jQuery 3.7.1, load it over https and add the subresource integrity hash (js/functionality-from-untrusted-source). --- openig-doc/src/main/resources/uma/alice.html | 4 +++- openig-doc/src/main/resources/uma/bob.html | 4 +++- openig-doc/src/main/resources/uma/index.html | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/openig-doc/src/main/resources/uma/alice.html b/openig-doc/src/main/resources/uma/alice.html index 64c591851..4fc534f5f 100644 --- a/openig-doc/src/main/resources/uma/alice.html +++ b/openig-doc/src/main/resources/uma/alice.html @@ -13,13 +13,15 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2015-2016 ForgeRock AS. + * Portions Copyright 2026 3A Systems, LLC. --> Alice (Resource Owner) - + diff --git a/openig-doc/src/main/resources/uma/bob.html b/openig-doc/src/main/resources/uma/bob.html index 38b41db31..218016425 100644 --- a/openig-doc/src/main/resources/uma/bob.html +++ b/openig-doc/src/main/resources/uma/bob.html @@ -13,13 +13,15 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2015 ForgeRock AS. + * Portions Copyright 2026 3A Systems, LLC. --> Bob (Requesting Party) - + diff --git a/openig-doc/src/main/resources/uma/index.html b/openig-doc/src/main/resources/uma/index.html index c21a3a0b1..242eb9285 100644 --- a/openig-doc/src/main/resources/uma/index.html +++ b/openig-doc/src/main/resources/uma/index.html @@ -13,13 +13,15 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2015 ForgeRock AS. + * Portions Copyright 2026 3A Systems, LLC. --> Trying User-Managed Access - + From 004aadad022fa1534961dc442436eb81f6490651 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 22 Oct 2026 14:55:17 +0300 Subject: [PATCH 2/2] Drop accepts: "json" from the UMA sample ajax calls accepts must be a map. Given the string "json", jQuery 3.x sends the header Accept: undefined, which 1.11.1 used to drop. Without the option the calls send Accept: */* as before. Also add a test that the UMA pages load the pinned jQuery over https with its SRI hash. --- openig-doc/src/main/resources/uma/alice.html | 12 ++++-------- openig-doc/src/main/resources/uma/bob.html | 6 ++---- .../openig/doc/SampleApplicationTest.java | 17 +++++++++++++++++ 3 files changed, 23 insertions(+), 12 deletions(-) diff --git a/openig-doc/src/main/resources/uma/alice.html b/openig-doc/src/main/resources/uma/alice.html index 4fc534f5f..ac1ee2133 100644 --- a/openig-doc/src/main/resources/uma/alice.html +++ b/openig-doc/src/main/resources/uma/alice.html @@ -83,8 +83,7 @@

Alice (Resource Owner)

"username": rs_username, "password": rs_password, "scope": rs_scope - }, - accepts: "json" + } }) .done(function (data) { $("#pat").html(json2html(data, "Protection API Token")); @@ -94,8 +93,7 @@

Alice (Resource Owner)

url: share_url, type: "POST", data: JSON.stringify({ "path": share, "pat": data.access_token }), - contentType: "application/json", - accepts: "json" + contentType: "application/json" }) .done(function (data) { $("#resource-set-id").html(json2html(data, "Resource Set ID")); @@ -110,8 +108,7 @@

Alice (Resource Owner)

xhr.setRequestHeader("X-OpenAM-Password", rs_password); }, data: JSON.stringify({}), - contentType: "application/json", - accepts: "json" + contentType: "application/json" }) .done(function (data) { $("#auth").html(json2html(data, "Authenticated as Alice")); @@ -135,8 +132,7 @@

Alice (Resource Owner)

} ] }), - contentType: "application/json", - accepts: "json" + contentType: "application/json" }) .done(function (data) { $("#share").html(json2html(data, "Permissions Shared ({} == Success)")); diff --git a/openig-doc/src/main/resources/uma/bob.html b/openig-doc/src/main/resources/uma/bob.html index 218016425..b815d2a5d 100644 --- a/openig-doc/src/main/resources/uma/bob.html +++ b/openig-doc/src/main/resources/uma/bob.html @@ -89,8 +89,7 @@

Bob (Requesting Party)

"username": uma_username, "password": uma_password, "scope": uma_scope - }, - accepts: "json" + } }) .done(function (data) { var aat = data.access_token; @@ -104,8 +103,7 @@

Bob (Requesting Party)

xhr.setRequestHeader("Authorization", "Bearer " + aat); }, data: JSON.stringify({ "ticket": ticket }), - contentType: "application/json", - accepts: "json" + contentType: "application/json" }) .done(function (data) { var rpt = data.rpt; diff --git a/openig-doc/src/test/java/org/forgerock/openig/doc/SampleApplicationTest.java b/openig-doc/src/test/java/org/forgerock/openig/doc/SampleApplicationTest.java index 632f934f2..a1282b5d0 100644 --- a/openig-doc/src/test/java/org/forgerock/openig/doc/SampleApplicationTest.java +++ b/openig-doc/src/test/java/org/forgerock/openig/doc/SampleApplicationTest.java @@ -12,6 +12,7 @@ * information: "Portions Copyright [year] [name of copyright owner]". * * Copyright 2014-2016 ForgeRock AS. + * Portions Copyright 2026 3A Systems, LLC. */ package org.forgerock.openig.doc; @@ -114,6 +115,22 @@ public void testGetLoginPageHttps() throws Exception { assertTrue(webResponse.getContentAsString().contains(LOGIN_TITLE)); } + @Test + public void testUmaPagesLoadPinnedJQueryOverHttps() throws Exception { + for (final String page : new String[] { "/uma/index.html", "/uma/alice.html", "/uma/bob.html" }) { + logger.info("Testing equivalent of curl --verbose " + httpServerPath + page); + + final WebRequest webRequest = new WebRequest(new URL(httpServerPath + page), GET); + final WebResponse webResponse = webClient.loadWebResponse(webRequest); + + assertEquals(webResponse.getStatusCode(), 200); + final String content = webResponse.getContentAsString(); + assertTrue(content.contains("src=\"https://code.jquery.com/jquery-3.7.1.min.js\""), page); + assertTrue(content.contains( + "integrity=\"sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo=\""), page); + } + } + @Test public void testPostValidCredentials() throws Exception {