[TT-16050]: Added key use in dynamic mtls behind insecure flag

cli/linter/schema.json

@@ -1131,6 +1131,9 @@
             "type": "object"
           }
         },
+        "allow_unsafe_dynamic_mtls_token": {
+          "type": "boolean"
+        },
         "certificates": {
           "type": ["object", "null"],
           "additionalProperties": false,

config/config.go

@@ -700,6 +700,11 @@ type SecurityConfig struct {
 	// Specify public keys used for Certificate Pinning on global level.
 	PinnedPublicKeys map[string]string `json:"pinned_public_keys"`
 
+	// AllowUnsafeDynamicMTLSToken controls whether certificate presence is required for
+	// dynamic mTLS authentication. If set to false (default), requests with a token but
+	// no certificate will be rejected for APIs using dynamic mTLS.
+	AllowUnsafeDynamicMTLSToken bool `json:"allow_unsafe_dynamic_mtls_token"`
+
 	Certificates CertificatesConfig `json:"certificates"`
 
 	// CertificateExpiryMonitor configures the certificate expiry monitoring and notification feature

gateway/auth_manager_test.go

@@ -247,7 +247,7 @@ func TestHashKeyFunctionChanged(t *testing.T) {
 			Data: session, Client: client, Code: http.StatusOK})
 
 		client = GetTLSClient(&clientCert, nil)
-		testChangeHashFunc(t, nil, client, http.StatusForbidden)
+		testChangeHashFunc(t, nil, client, http.StatusUnauthorized)
 	})
 
 }

gateway/cert_test.go

@@ -1387,7 +1387,7 @@ func TestKeyWithCertificateTLS(t *testing.T) {
 		client := GetTLSClient(&clientCert, nil)
 
 		t.Run("Cert unknown", func(t *testing.T) {
-			_, _ = ts.Run(t, test.TestCase{Code: 403, Client: client})
+			_, _ = ts.Run(t, test.TestCase{Code: 401, Client: client})
 		})
 
 		t.Run("Cert known", func(t *testing.T) {
@@ -1451,7 +1451,7 @@ func TestKeyWithCertificateTLS(t *testing.T) {
 		t.Run("Cert unknown", func(t *testing.T) {
 			_, _ = ts.Run(t,
 				test.TestCase{Code: 404, Path: "/test1", Client: client},
-				test.TestCase{Code: 403, Path: "/test1", Domain: "localhost", Client: client},
+				test.TestCase{Code: 401, Path: "/test1", Domain: "localhost", Client: client},
 			)
 		})
 
@@ -1492,7 +1492,14 @@ func TestKeyWithCertificateTLS(t *testing.T) {
 					TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 				},
 			}
+			globalConf := ts.Gw.GetConfig()
+			globalConf.Security.AllowUnsafeDynamicMTLSToken = true
+			ts.Gw.SetConfig(globalConf)
 			_, _ = ts.Run(t, test.TestCase{Path: "/test1", Headers: header, Code: http.StatusOK, Domain: "localhost", Client: client})
+
+			globalConf = ts.Gw.GetConfig()
+			globalConf.Security.AllowUnsafeDynamicMTLSToken = false
+			ts.Gw.SetConfig(globalConf)
 		})
 	})
 
@@ -1526,8 +1533,8 @@ func TestKeyWithCertificateTLS(t *testing.T) {
 
 		_, _ = ts.Run(t, []test.TestCase{
 			{Code: http.StatusNotFound, Path: "/test1", Client: client},
-			{Code: http.StatusForbidden, Path: "/test1", Domain: "host1", Client: client},
-			{Code: http.StatusForbidden, Path: "/test1", Domain: "host2", Client: client},
+			{Code: http.StatusUnauthorized, Path: "/test1", Domain: "host1", Client: client},
+			{Code: http.StatusUnauthorized, Path: "/test1", Domain: "host2", Client: client},
 		}...)
 
 		_, _ = ts.CreateSession(func(s *user.SessionState) {
@@ -1579,6 +1586,16 @@ func TestKeyWithCertificateTLS(t *testing.T) {
 
 	// check that key has been updated with wrong certificate
 	t.Run("Key has been updated with wrong certificate key", func(t *testing.T) {
+		globalConf := ts.Gw.GetConfig()
+		globalConf.Security.AllowUnsafeDynamicMTLSToken = true
+		ts.Gw.SetConfig(globalConf)
+
+		defer func() {
+			globalConf = ts.Gw.GetConfig()
+			globalConf.Security.AllowUnsafeDynamicMTLSToken = false
+			ts.Gw.SetConfig(globalConf)
+		}()
+
 		clientPEM, _, _, clientCert := crypto.GenCertificate(&x509.Certificate{}, false)
 		clientCertID, err := ts.Gw.CertificateManager.Add(clientPEM, orgId)
 

gateway/handler_error.go

@@ -28,6 +28,7 @@ const (
 
 	MsgAuthFieldMissing                        = "Authorization field missing"
 	MsgApiAccessDisallowed                     = "Access to this API has been disallowed"
+	MsgAuthCertRequired                        = "Client certificate required"
 	MsgBearerMailformed                        = "Bearer token malformed"
 	MsgKeyNotAuthorized                        = "Key not authorised"
 	MsgOauthClientRevoked                      = "Key not authorised. OAuth client access was revoked"

gateway/mw_auth_key.go

@@ -28,8 +28,9 @@
 	ErrAuthKeyNotFound               = "auth.key_not_found"
 	ErrAuthCertNotFound              = "auth.cert_not_found"
 	ErrAuthCertExpired               = "auth.cert_expired"
-	ErrAuthCertMismatch              = "auth.cert_mismatch"
 	ErrAuthKeyIsInvalid              = "auth.key_is_invalid"
+	ErrAuthCertRequired              = "auth.cert_required"
+	ErrAuthCertMismatch              = "auth.cert_mismatch"
 
 	MsgNonExistentKey      = "Attempted access with non-existent key."
 	MsgNonExistentCert     = "Attempted access with non-existent cert."
@@ -63,9 +64,14 @@
 		Code:    http.StatusForbidden,
 	}
 
+	TykErrors[ErrAuthCertRequired] = config.TykError{
+		Message: MsgAuthCertRequired,
+		Code:    http.StatusUnauthorized,
+	}
+
 	TykErrors[ErrAuthCertMismatch] = config.TykError{
 		Message: MsgApiAccessDisallowed,
-		Code:    http.StatusForbidden,
+		Code:    http.StatusUnauthorized,
 	}
 }
 
@@ -92,50 +98,89 @@
 }
 
 // getAuthType overrides BaseMiddleware.getAuthType.
 func (k *AuthKey) getAuthType() string {
 	return apidef.AuthTokenType
 }
 
+// checkSessionWithCertFallback attempts to find a session using a generated token from certHash,
+// falling back to checking with the certHash directly if the token lookup fails.
+func (k *AuthKey) checkSessionWithCertFallback(r *http.Request, certHash string) (user.SessionState, bool) {
+	key := k.Gw.generateToken(k.Spec.OrgID, certHash)
+	session, keyExists := k.CheckSessionAndIdentityForValidKey(key, r)
+	if !keyExists {
+		session, keyExists = k.CheckSessionAndIdentityForValidKey(certHash, r)
+	}
+	return session, keyExists
+}
+
 func (k *AuthKey) ProcessRequest(_ http.ResponseWriter, r *http.Request, _ interface{}) (error, int) {
 	if ctxGetRequestStatus(r) == StatusOkAndIgnore {
 		return nil, http.StatusOK
 	}
 
 	// skip auth key check if the request is looped.
 	if ses := ctxGetSession(r); ses != nil && httpctx.IsSelfLooping(r) {
 		return nil, http.StatusOK
 	}
 
 	key, authConfig := k.getAuthToken(k.getAuthType(), r)
-	var certHash string
-
-	keyExists := false
-	var session user.SessionState
-	updateSession := false
 	if key != "" {
 		key = stripBearer(key)
-	} else if authConfig.UseCertificate && key == "" && r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
-		log.Debug("Trying to find key by client certificate")
-		certHash = k.Spec.OrgID + crypto.HexSHA256(r.TLS.PeerCertificates[0].Raw)
-		if time.Now().After(r.TLS.PeerCertificates[0].NotAfter) {
-			return errorAndStatusCode(ErrAuthCertExpired)
-		}
-
-		key = k.Gw.generateToken(k.Spec.OrgID, certHash)
-	} else {
-		k.Logger().Info("Attempted access with malformed header, no auth header found.")
-		return errorAndStatusCode(ErrAuthAuthorizationFieldMissing)
 	}
+	var keyExists, updateSession bool
+	var certHash string
+	var session user.SessionState
 
 	session, keyExists = k.CheckSessionAndIdentityForValidKey(key, r)
-	key = session.KeyID
-	if !keyExists {
-		// fallback to search by cert
-		session, keyExists = k.CheckSessionAndIdentityForValidKey(certHash, r)
+	if !authConfig.UseCertificate {
+		if key == "" {
+			k.Logger().Info("Attempted access with malformed header, no auth header found.")
+			return errorAndStatusCode(ErrAuthAuthorizationFieldMissing)
+		}
 		if !keyExists {
 			return k.reportInvalidKey(key, r, MsgNonExistentKey, ErrAuthKeyNotFound)
 		}
 	}
+	if authConfig.UseCertificate && r.TLS != nil {
+		if len(r.TLS.PeerCertificates) > 0 {
+			if time.Now().After(r.TLS.PeerCertificates[0].NotAfter) {
+				return errorAndStatusCode(ErrAuthCertExpired)
+			}
+			certHash = k.Spec.OrgID + crypto.HexSHA256(r.TLS.PeerCertificates[0].Raw)
+		}
+
+		if !k.Gw.GetConfig().Security.AllowUnsafeDynamicMTLSToken {
+			if certHash == "" {
+				return errorAndStatusCode(ErrAuthCertRequired)
+			}
+			session, keyExists = k.checkSessionWithCertFallback(r, certHash)
+			if !keyExists {
+				return errorAndStatusCode(ErrAuthCertMismatch)
+			}
+		} else {
+			if certHash != "" {
+				session, keyExists = k.checkSessionWithCertFallback(r, certHash)
+				if !keyExists {
+					return errorAndStatusCode(ErrAuthCertMismatch)
+				}
+			}
+			if key != "" {
+				session, keyExists = k.CheckSessionAndIdentityForValidKey(key, r)
+				if !keyExists {
+					return k.reportInvalidKey(key, r, MsgNonExistentKey, ErrAuthKeyNotFound)
+				}
+			}
+		}
+	} else {
+		if !keyExists {
+			// fallback to search by cert
+			session, keyExists = k.CheckSessionAndIdentityForValidKey(certHash, r)
+			if !keyExists {
+				return k.reportInvalidKey(key, r, MsgNonExistentKey, ErrAuthKeyNotFound)
+			}
+		}
+	}
+	key = session.KeyID
 
 	// Validate certificate binding or dynamic mTLS
 	// Certificate binding validation runs when:
@@ -313,17 +358,17 @@
 
 // validateWithTLSCertificate handles validation when a TLS client certificate is provided
 func (k *AuthKey) validateWithTLSCertificate(ctx *certValidationContext) (int, error) {
-	// Check certificate expiry when a token is provided (not checked earlier in the flow)
-	if code, err := k.checkCertificateExpiry(ctx.request, ctx.key); err != nil {
-		return code, err
-	}
-
 	// Compute cert hash for comparison
 	*ctx.certHash = k.computeCertHash(ctx.request, *ctx.certHash)
 
 	// Use binding mode if the session has static certificate bindings configured
 	// Otherwise, use legacy mode for backward compatibility with dynamic mTLS
 	if ctx.useCertBinding {
+		// Check certificate expiry for cert binding mode
+		// (not checked earlier in the flow, unlike when authConfig.UseCertificate is true)
+		if code, err := k.checkCertificateExpiry(ctx.request, ctx.key); err != nil {
+			return code, err
+		}
 		return k.validateCertificateBinding(ctx.request, ctx.key, ctx.session, *ctx.certHash)
 	}
 

gateway/mw_auth_key_certificate_binding_test.go

@@ -59,7 +59,6 @@ func TestCertificateTokenBinding(t *testing.T) {
 		spec.ClientCertificates = []string{clientCertID1, clientCertID2}
 		authConf := apidef.AuthConfig{
 			Name:           "authToken",
-			UseCertificate: true,
 			AuthHeaderName: "Authorization",
 		}
 		spec.AuthConfigs = map[string]apidef.AuthConfig{
@@ -112,7 +111,7 @@ func TestCertificateTokenBinding(t *testing.T) {
 			Client:    client2,
 			Path:      "/cert-binding",
 			Headers:   map[string]string{"Authorization": key},
-			Code:      http.StatusForbidden,
+			Code:      http.StatusUnauthorized,
 			BodyMatch: MsgApiAccessDisallowed,
 		})
 	})

gateway/mw_auth_key_mtls_combined_test.go

@@ -31,6 +31,7 @@ func TestStaticAndDynamicMTLS(t *testing.T) {
 		globalConf.HttpServerOptions.UseSSL = true
 		globalConf.HttpServerOptions.SSLInsecureSkipVerify = true
 		globalConf.HttpServerOptions.SSLCertificates = []string{"default" + certID}
+		globalConf.Security.AllowUnsafeDynamicMTLSToken = true
 	}
 	ts := StartTest(conf)
 	defer ts.Close()
@@ -111,7 +112,6 @@ func TestStaticAndDynamicMTLS(t *testing.T) {
 	t.Run("Legacy dynamic mTLS auto-updates session certificate", func(t *testing.T) {
 		// In legacy mode (using session.Certificate without MtlsStaticCertificateBindings),
 		// the session certificate gets auto-updated with the current cert hash.
-		// This means ANY allowlisted certificate will work - no strict binding enforcement.
 		key := CreateSession(ts.Gw, func(s *user.SessionState) {
 			s.AccessRights = map[string]user.AccessDefinition{"combined-mtls-api": {
 				APIID: "combined-mtls-api",
@@ -121,15 +121,14 @@ func TestStaticAndDynamicMTLS(t *testing.T) {
 
 		assert.NotEmpty(t, key, "Should create key with certificate binding")
 
-		// Request with cert2 (in allowlist) will succeed and auto-update session to cert2
-		// This is the legacy behavior - no strict binding enforcement
+		// Request will fail because client2 is invalid and is being used to access the api
 		client2 := GetTLSClient(&clientCert2, serverCertPem)
 		_, _ = ts.Run(t, test.TestCase{
 			Domain:  "localhost",
 			Client:  client2,
 			Path:    "/combined-mtls",
 			Headers: map[string]string{"Authorization": key},
-			Code:    http.StatusOK, // Passes in legacy mode
+			Code:    http.StatusUnauthorized, // Passes in legacy mode
 		})
 	})
 
@@ -181,6 +180,8 @@ func TestStaticAndDynamicMTLS(t *testing.T) {
 
 	t.Run("Fail: invalid auth token with valid cert", func(t *testing.T) {
 		// Request with valid cert but invalid token
+		// should the token still be validated if the cert is passed
+		// disable insecure
 		client1 := GetTLSClient(&clientCert1, serverCertPem)
 		_, _ = ts.Run(t, test.TestCase{
 			Domain:    "localhost",
@@ -232,7 +233,7 @@ func TestStaticAndDynamicMTLS(t *testing.T) {
 			Client:    client1,
 			Path:      "/combined-mtls",
 			Headers:   map[string]string{"Authorization": key},
-			Code:      http.StatusForbidden,
+			Code:      http.StatusUnauthorized,
 			BodyMatch: MsgApiAccessDisallowed,
 		})
 	})
@@ -279,15 +280,14 @@ func TestStaticAndDynamicMTLS(t *testing.T) {
 		})
 
 		t.Run("different certificate auto-updates session in legacy mode", func(t *testing.T) {
-			// In legacy dynamic mTLS mode, the session.Certificate gets auto-updated
-			// So using a different certificate will succeed and update the session
+			// should fail, certificate is invalid
 			wrongCertClient := GetTLSClient(&clientCert2, serverCertPem)
 			_, _ = ts.Run(t, test.TestCase{
 				Domain:  "localhost",
 				Client:  wrongCertClient,
 				Path:    "/dynamic-only",
 				Headers: map[string]string{"Authorization": key},
-				Code:    http.StatusOK, // Legacy mode allows any valid cert
+				Code:    http.StatusUnauthorized, // Legacy mode allows any valid cert
 			})
 		})
 	})
@@ -360,6 +360,7 @@ func TestCertificateCheckMW_StrictAllowlistValidation(t *testing.T) {
 		globalConf.HttpServerOptions.UseSSL = true
 		globalConf.HttpServerOptions.SSLInsecureSkipVerify = true
 		globalConf.HttpServerOptions.SSLCertificates = []string{"default" + certID}
+		globalConf.Security.AllowUnsafeDynamicMTLSToken = true
 	}
 	ts := StartTest(conf)
 	defer ts.Close()
@@ -517,6 +518,7 @@ func TestStaticAndDynamicMTLS_ExpiredCertificate(t *testing.T) {
 		globalConf.HttpServerOptions.UseSSL = true
 		globalConf.HttpServerOptions.SSLInsecureSkipVerify = true
 		globalConf.HttpServerOptions.SSLCertificates = []string{"default" + certID}
+		globalConf.Security.AllowUnsafeDynamicMTLSToken = true
 	}
 	ts := StartTest(conf)
 	defer ts.Close()
@@ -618,6 +620,7 @@ func TestDynamicMTLS_InvalidCertificateInSession(t *testing.T) {
 		globalConf.HttpServerOptions.UseSSL = true
 		globalConf.HttpServerOptions.SSLInsecureSkipVerify = true
 		globalConf.HttpServerOptions.SSLCertificates = []string{"default" + certID}
+		globalConf.Security.AllowUnsafeDynamicMTLSToken = true
 	}
 	ts := StartTest(conf)
 	defer ts.Close()
@@ -709,6 +712,7 @@ func TestMultipleCertificateBindings(t *testing.T) {
 		globalConf.HttpServerOptions.UseSSL = true
 		globalConf.HttpServerOptions.SSLInsecureSkipVerify = true
 		globalConf.HttpServerOptions.SSLCertificates = []string{"default" + certID}
+		globalConf.Security.AllowUnsafeDynamicMTLSToken = true
 	}
 	ts := StartTest(conf)
 	defer ts.Close()
@@ -757,10 +761,19 @@ func TestMultipleCertificateBindings(t *testing.T) {
 			s.AccessRights = map[string]user.AccessDefinition{"multi-binding-api": {
 				APIID: "multi-binding-api",
 			}}
+			s.Certificate = certHash1
 			// Bind multiple certificates to the same token
 			s.MtlsStaticCertificateBindings = []string{certHash1, certHash2}
 		})
 
+		key2 := CreateSession(ts.Gw, func(s *user.SessionState) {
+			s.AccessRights = map[string]user.AccessDefinition{"multi-binding-api": {
+				APIID: "multi-binding-api",
+			}}
+			s.Certificate = certHash2
+			s.MtlsStaticCertificateBindings = []string{certHash2, certHash1}
+		})
+
 		assert.NotEmpty(t, key, "Should create key with multiple certificate bindings")
 
 		// Both certificates should work
@@ -778,7 +791,7 @@ func TestMultipleCertificateBindings(t *testing.T) {
 			Domain:  "localhost",
 			Client:  client2,
 			Path:    "/multi-binding",
-			Headers: map[string]string{"Authorization": key},
+			Headers: map[string]string{"Authorization": key2},
 			Code:    http.StatusOK,
 		})
 	})