{"record":{"id":"d1b8cff958ef2c07","repo":"apereo/cas","slug":"the-x-509-feature-over-rest-using-header-body-auth","errorCode":null,"errorMessage":"The X.509 feature over REST using header/body authentication provides a tremendously convenient target for claiming user identities or obtaining TGTs without proof of private key ownership. To securely use this feature, network configuration MUST allow connections to the CAS server only from trusted hosts which in turn have strict security limitations and logging. Thus, TLS authentication shouldn't be activated together with header or body authentication.","messagePattern":"The X\\.509 feature over REST using header/body authentication provides a tremendously convenient target for claiming user identities or obtaining TGTs without proof of private key ownership\\. To securely use this feature, network configuration MUST allow connections to the CAS server only from trusted hosts which in turn have strict security limitations and logging\\. Thus, TLS authentication shouldn't be activated together with header or body authentication\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-rest-x509/src/main/java/org/apereo/cas/config/CasX509RestAutoConfiguration.java","lineNumber":103,"sourceCode":"        @Bean\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @ConditionalOnMissingBean(name = \"x509RestHttpRequestCredentialFactoryConfigurer\")\n        public RestHttpRequestCredentialFactoryConfigurer x509RestHttpRequestCredentialFactoryConfigurer(\n            @Qualifier(\"x509RestTlsClientCert\")\n            final ObjectProvider<RestHttpRequestCredentialFactory> x509RestTlsClientCert,\n            @Qualifier(\"x509RestMultipartBody\")\n            final ObjectProvider<RestHttpRequestCredentialFactory> x509RestMultipartBody,\n            @Qualifier(\"x509RestRequestHeader\")\n            final ObjectProvider<RestHttpRequestCredentialFactory> x509RestRequestHeader,\n            final CasConfigurationProperties casProperties) {\n            return factory -> {\n                val restProperties = casProperties.getRest().getX509();\n                val headerAuth = restProperties.isHeaderAuth();\n                val bodyAuth = restProperties.isBodyAuth();\n                val tlsClientAuth = restProperties.isTlsClientAuth();\n\n                if (tlsClientAuth && (headerAuth || bodyAuth)) {\n                    LOGGER.warn(\"The X.509 feature over REST using header/body authentication provides a tremendously \"\n                                + \"convenient target for claiming user identities or obtaining TGTs without proof of private \"\n                                + \"key ownership. To securely use this feature, network configuration MUST allow connections \"\n                                + \"to the CAS server only from trusted hosts which in turn have strict security limitations \"\n                                + \"and logging. Thus, TLS authentication shouldn't be activated together with header \"\n                                + \"or body authentication.\");\n                }\n\n                if (headerAuth) {\n                    x509RestRequestHeader.ifAvailable(factory::registerCredentialFactory);\n                }\n                if (bodyAuth) {\n                    x509RestMultipartBody.ifAvailable(factory::registerCredentialFactory);\n                }\n                if (tlsClientAuth) {\n                    x509RestTlsClientCert.ifAvailable(factory::registerCredentialFactory);\n                }\n            };\n        }","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-rest-x509/src/main/java/org/apereo/cas/config/CasX509RestAutoConfiguration.java#L85-L121","documentation":"CasX509RestAutoConfiguration.x509RestHttpRequestCredentialFactoryConfigurer validates the combination of cas.rest.x509 settings. If tlsClientAuth is enabled together with headerAuth or bodyAuth, it logs this security warning: header/body auth would let clients claim identities or get TGTs without proving possession of the X.509 private key, defeating mutual TLS. This is a configuration-time warning, not a runtime exception.","triggerScenarios":"Setting cas.rest.x509.tls-client-auth=true while also setting cas.rest.x509.header-auth=true or cas.rest.x509.body-auth=true in application properties.","commonSituations":"Enabling all X.509 REST switches 'to be safe' during initial setup; copying a dev config with header auth into a production TLS-authenticated deployment; misunderstanding that header auth is meant for deployments where TLS termination happens without client certs.","solutions":["Disable header-auth and body-auth (set them to false) when tls-client-auth is enabled","If you must keep header/body auth, restrict network access to CAS to fully trusted hosts with strict logging, as the warning prescribes","Terminate TLS yourself only if you re-inject validated client-cert headers from a trusted TLS-terminating proxy","Remove the unused x509 REST properties entirely if the feature is not needed"],"exampleFix":"// before\ncas.rest.x509.tls-client-auth=true\ncas.rest.x509.header-auth=true\n// after\ncas.rest.x509.tls-client-auth=true\ncas.rest.x509.header-auth=false\ncas.rest.x509.body-auth=false","handlingStrategy":"validation","validationCode":"// fail startup/config validation when both are on\nif (tlsClientAuth && (headerAuth || bodyAuth)) {\n    throw new IllegalStateException('Disable header/body auth when TLS client auth is enabled');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never combine cas.rest.x509.tls-client-auth with header-auth/body-auth","Restrict network access to CAS when header/body X.509 auth is used","Review x509 REST properties during security audits"],"tags":["x509","security","configuration","mutual-tls","rest"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}