)]}'
{"id":"openstack%2Fkeystone~1002570","triplet_id":"openstack%2Fkeystone~master~I931ba657d45a41e0ef933867f1ccd810751ea606","project":"openstack/keystone","branch":"master","hashtags":[],"change_id":"I931ba657d45a41e0ef933867f1ccd810751ea606","subject":"Add optional nonce to WebSSO for CSRF protection","status":"NEW","created":"2026-08-27 00:12:10.000000000","updated":"2026-08-27 02:11:16.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"93ee0b6b819c2dc9dc0ac967f6ac68f09e2bae4f","_number":1002570,"virtual_id_number":1002570,"owner":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-27 01:19:37.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-27 01:19:37.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"35aee7b855807880a08967719a39df45fd93269c","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-08-27 00:12:10.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"acf20591de32f292bbaa2096d13edf6d51a4aef9","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 01:19:37.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d1b7c843dd3c48e999125e09fed70af4\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/8634f8622d5a4090beb967c335aefcc2 : SUCCESS in 16m 46s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5bb2e2af29b445858c875849ef91d6f5 : SUCCESS in 3m 36s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/94afecae74654443a5f84a6a22dce628 : SUCCESS in 11m 13s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/ca604dd736594f9a99741629ac9c00a6 : SUCCESS in 11m 23s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/6cd74761cfea4fdfa03ad06ab5706b1b : SUCCESS in 14m 57s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7b6030a9b7be4fc68ffaae8e36f085c2 : SUCCESS in 14m 35s\n- grenade https://zuul.opendev.org/t/openstack/build/647fd6a9594546ab84d60dcc73d432de : SUCCESS in 1h 02m 26s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/42520f9af42348368e28453b84817298 : SUCCESS in 46m 41s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/47b3bd23ac084ec3848e21dd1a8c7c86 : SUCCESS in 8m 59s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/fc7586db475a428487b5038fe9ddc0da : SUCCESS in 11m 00s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/6ba9e4cc90eb46138def2b6ed0ef77f2 : SUCCESS in 25m 05s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/089b91b755074644bacd019297396c8a : FAILURE in 22m 47s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/44e3733af8c94e3c9c5bcd06ed37a63b : FAILURE in 25m 06s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/441ea81b7cf34d8d8f01f30b4f92db6d : SUCCESS in 20m 51s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c0b1acfeea834cb6881838210956b806 : SUCCESS in 52m 55s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e7d49b6f977742d18099a4c11e8bf786 : SUCCESS in 23m 28s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4b7d69f0a91e44f8b3b44bcc69fb393b : SUCCESS in 56m 32s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/61145dfbf38f49c888996e9d1c9e6b25 : SUCCESS in 18m 10s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/530520ed40204c6fabec56a0d699f4da : SUCCESS in 6m 17s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"93ee0b6b819c2dc9dc0ac967f6ac68f09e2bae4f","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 02:11:16.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a1915c0e82464ebf89578207dc2cb66b\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/a6e6660f09ee4091aaf5a4bb00e2feaa : SUCCESS in 28m 03s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/6f3b22cd789a45fcb9a0c5cf16e1760b : SUCCESS in 25m 55s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/a2090ba89e8143c7a1deca6dab4eb668 : SUCCESS in 37m 05s (non-voting)","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"a7414f3bea361e21d9af8db43a6ee4a3ad50c297","revisions":{"a7414f3bea361e21d9af8db43a6ee4a3ad50c297":{"kind":"REWORK","_number":1,"created":"2026-08-27 00:12:10.000000000","uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/70/1002570/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/70/1002570/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1002570/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1002570/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1002570/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/70/1002570/1"}}},"commit":{"parents":[{"commit":"16afc813b7e6de727d8a91e065d7824b06e32925","subject":"Merge \"Abandon server-side paged search cursor when sizelimit is reached\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/16afc813b7e6de727d8a91e065d7824b06e32925"}]}],"author":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-08-25 04:12:47.000000000","tz":0},"committer":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-08-27 00:12:09.000000000","tz":-300},"subject":"Add optional nonce to WebSSO for CSRF protection","message":"Add optional nonce to WebSSO for CSRF protection\n\nThe WebSSO federated auth flow protects *where* a token is returned\nvia the origin/trusted_dashboard check, but nothing ties an SSO\nresponse back to the specific login request a dashboard initiated.\nThis leaves the callback open to CSRF/login-CSRF style attacks.\n\nAccept an optional `nonce` query parameter on the WebSSO endpoints and\nreflect it verbatim into the callback form. A dashboard can generate\nan unpredictable nonce, store it in the user\u0027s session, and verify the\nreturned value to correlate the response with its request.\n\nThe change is fully backwards compatible:\n\n- A request without a nonce behaves exactly as before; the shipped\n  template renders an empty hidden nonce field that dashboards ignore.\n- Custom sso_callback_template files keep working (substitute ignores\n  the extra key); operators add a `$nonce` field to opt in.\n\nThe nonce is attacker-controllable text reflected into HTML, so it gets\ntwo independent defenses: it must fullmatch `[A-Za-z0-9_-]{1,128}` or\nthe request is rejected, and it is HTML-escaped when rendered so that\nthe template stays safe even if the character set is ever loosened. A\ncustom template with no `$nonce` placeholder still renders, but the\ndropped nonce is logged rather than silently discarded.\n\nNote: this is reflect-only. Keystone does not yet advertise nonce\nsupport through version discovery, so during a mixed-version upgrade a\ndashboard cannot safely hard-require the nonce and must degrade\ngracefully. Advertising the capability so dashboards can enforce\nstrictly is planned as a follow-up change.\n\nAssisted-by: Claude Sonnet 5\nChange-Id: I931ba657d45a41e0ef933867f1ccd810751ea606\nSigned-off-by: Doug Goldstein \u003ccardoe@cardoe.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a7414f3bea361e21d9af8db43a6ee4a3ad50c297"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a7414f3bea361e21d9af8db43a6ee4a3ad50c297"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}