mirror/galene
1
Fork 0
mirror of https://github.com/jech/galene.git synced 2024-11-22 08:35:57 +01:00
Code Activity

More JWT paranoia.

Browse source
This commit is contained in:
Juliusz Chroboczek 2024-05-11 22:45:52 +02:00
parent 4eaf6d058a
commit d9e956be48
3 changed files with 14 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
README
View file

@ -301,8 +301,9 @@ existing authentication and authorisation infrastructure, such as LDAP,
OAuth2 or even Unix passwords. OAuth2 or even Unix passwords.
When an authorisation server is used, the group configuration file When an authorisation server is used, the group configuration file
specifies one or more public keys in JWK format. In addition, it may specifies one or more public keys in JWK format (with the restriction that
specify either an authorisation server or an authorisation portal. the "alg" key must be specified). In addition, it may specify either an
authorisation server or an authorisation portal.
{ {
"authKeys": [{ "authKeys": [{

2
group/description.go
View file

@ -581,7 +581,7 @@ func SetWildcardUser(group string, user *UserDescription) error {
func SetKeys(group string, keys []map[string]any) error { func SetKeys(group string, keys []map[string]any) error {
if keys != nil { if keys != nil {
_, err := token.ParseKeys(keys, "") _, err := token.ParseKeys(keys, "", "")
if err != nil { if err != nil {
return err return err
} }

13
token/jwt.go
View file

@ -96,10 +96,13 @@ func ParseKey(key map[string]any) (any, error) {
} }
} }
func ParseKeys(keys []map[string]any, kid string) ([]jwt.VerificationKey, error) { func ParseKeys(keys []map[string]any, alg, kid string) ([]jwt.VerificationKey, error) {
ks := make([]jwt.VerificationKey, 0, len(keys)) ks := make([]jwt.VerificationKey, 0, len(keys))
for _, ky := range keys { for _, ky := range keys {
// return all keys if kid is not specified // return all keys if alg and kid are not specified
if alg != "" && ky["alg"] != alg {
continue
}
if kid != "" && ky["kid"] != kid { if kid != "" && ky["kid"] != kid {
continue continue
} }
@ -135,8 +138,12 @@ func parseJWT(token string, keys []map[string]any) (*JWT, error) {
t, err := jwt.Parse( t, err := jwt.Parse(
token, token,
func(t *jwt.Token) (any, error) { func(t *jwt.Token) (any, error) {
alg, _ := t.Header["alg"].(string)
if alg == "" {
return nil, errors.New("alg not found")
}
kid, _ := t.Header["kid"].(string) kid, _ := t.Header["kid"].(string)
ks, err := ParseKeys(keys, kid) ks, err := ParseKeys(keys, alg, kid)
if err != nil { if err != nil {
return nil, err return nil, err
} }