Validate HEAD requests properly before clicking on password reset link received via an email

[jbilandzija]

SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org

Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.

What version of UAA are you running?

We are using 76.13.0.

How are you deploying the UAA?

I am deploying the UAA

• using a bosh release I downloaded from bosh.io

What did you do?

1. User tries to reset his password by clicking "Reset password" on UAA Login screen.
2. User provides email and clicks "SEND RESET PASSWORD LINK"
3. User opens the link and receives "Sorry, your reset password link is no longer valid. You can request another one below."

Current observation

Users having these issues are using Outlook and probably Outlook's Safelink protection invalidates the link even before user can.

What did you expect to see? What goal are you trying to achieve with the UAA?

• Passwort reset window opens to set a new password

What did you see instead?

Error panel saying "Sorry, your reset password link is no longer valid. You can request another one below."

Assumption

Outlook's safelink protection opens the link as HEAD request which is handled as GET. Potential fix would be to handle HEAD requests properly before clicking on password reset link received via an email

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/185449489

The labels on this github issue will be updated when the story is started.

[strehle]

you have created 2 PRs, are there more to come from your side ?

[jbilandzija]

@strehle That's all from my side