Comments (10)
Sounds good.
We use our own Verifier middleware, so that's where the confusion came from. Good catch!
from jwtauth.
Any update? 😁 Seems like a semi-serious security flaw.
from jwtauth.
@ernsheong which default validations are missing besides checking validity of the signature, the algo matches and the token isn't expired? as in https://github.com/go-chi/jwtauth/blob/master/jwtauth.go#L109-L130
from jwtauth.
Something I can think of is the "aud" claim. Tricky but ideal is how can we let the caller handle this on their own without letting this library do all the heavy lifting.
from jwtauth.
@ernsheong in this case, as the docs suggest, you should write your own Verifier where the defaults aren't sufficient. But I don't see any security issues with the default, but as security issues are serious, it's nice to have a second set of eyes
from jwtauth.
Apologies, I might have overstated. Seems more acceptable now that I've studied it further.
Another separate concern is I'm not sure where this is coming from. Couldn't trace it from jwt-go:
https://github.com/go-chi/jwtauth/blob/master/jwtauth.go#L112
Also, the docs said to "write your own" Authenticator
, so I assumed Verifier
was supposed to not be customizable.
from jwtauth.
@ernsheong yea, good catch on that line. It's likely to do nothing at all, and was made to offer a more explicit error, but wouldn't be a security flaw. We should improve that for sure
from jwtauth.
@pkieltyka Thanks for the quick replies, created #29 to track that. Loving chi
! Sorry for spamming this thread 😅
from jwtauth.
@ernsheong naw dude, thank you for giving it a look and submitting the concern, we can definitely improve it given the noop code :)
from jwtauth.
I'll close this so we can continue in #29
from jwtauth.
Related Issues (20)
- How set expires time in MapClaims HOT 1
- jwtauth: token is expired HOT 2
- Having a hard time setting up a custom authenticator function
- Move away from unmaintained dgrijalva/jwt-go HOT 10
- I seem to be having issues and errors with NBF HOT 4
- go get github.com/go-chi/jwtauth fails HOT 1
- Getting same token for every request HOT 3
- `null` values in token lead to panic in jwtauth.Authenticator HOT 5
- Altering Validation Options to jwt.Validate() HOT 1
- README and Comments Corrections After JWT Lib Change HOT 1
- int turns float64 after decode HOT 1
- OIDC Discovery functionality HOT 2
- How to determine token type on Verify? HOT 2
- Usage with Auth0 with ID Token HOT 1
- TokenFromQuery is missing in Verifier HOT 5
- How to use JWT expiration? HOT 1
- jwt.Validate in jwtauth.Authenticator package error HOT 2
- Getting 401 unauthorized when passing token on multiple services
- Allow users to retrieve JWT from a query and cookie with a specified name HOT 1
- Missing error handling when set claim fields
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jwtauth.