Comments (8)
In the meantime I've checked a few other libraries, noteably:
- Java, https://bitbucket.org/b_c/jose4j/src/ab4080d997c9eb56b47f0ca942cdd21de2586178/src/main/java/org/jose4j/jwt/consumer/IssValidator.java?at=master
- Python
- Node.JS, https://github.com/auth0/node-jsonwebtoken/blob/master/index.js#L181
and they all check the issuer claim when it's present in the options.
from ruby-jwt.
This is a bug. After inspecting the code, the verification is triggered only when the iss payload is present. See: https://github.com/progrium/ruby-jwt/blob/master/lib/jwt.rb#L166
This affects also all the other verifications.
Thanks for reporting. If you find the time to provide a PR I'd be happy to merge it.
from ruby-jwt.
All right, I'd propose the following
- Setting
verify_iss
andverify_aud
by default totrue
- Change the conditions to be like
if options[:verify_iss] && options["iss"]
...
This change then has verification of issuer enabled - as soon as iss
option is set, or would you prefer to leave verify_iss
to be false by default?
PS: Btw, what is the reasoning behind using "iss"
as option and not :iss
?
from ruby-jwt.
I agree with your proposal. With these changes it would become more easy to setup the library and check created tokens. But this would break the current api. In this case it would be required to switch to version 2.0. I don't have a problem with this next version step.
The use of 'iss' instead of :iss was a mistake in the code review process. It simply slipped through and now it is in the current version. A fix for this could be this active support library. http://api.rubyonrails.org/classes/ActiveSupport/HashWithIndifferentAccess.html But this won't be needed if we make the version 2.0 step. In this case we can change everything to use the hash syntax and drop the ruby 1.8.x support.
from ruby-jwt.
Then I'd propose the following:
- Bugfix release 1.5.x, where
verify_iss
andverify_aud
are still set to tofalse
-> will create a PR for this part - Breaking changes to be introduced in a 2.0 release, looking at how the current verification works, I think there are a few other areas that could be slightly adapted (similar issues, e.g. there's no way of saying: Hey, I require an
exp
)
from ruby-jwt.
Sounds excellent. 👍
If you have some ideas for version 2.0 send me a mail.
from ruby-jwt.
I just created a google group. https://groups.google.com/forum/#!forum/ruby-jwt Drop your ideas there. :)
from ruby-jwt.
Created a PR, so I'm closing this.
from ruby-jwt.
Related Issues (20)
- Bug: undefined method `casecmp' for nil:NilClass when invalid alg
- Support x5t in place of kid
- verification of at_hash == access_token HOT 4
- OpenSSL 3 - Unable to create OpenSSL::PKey instances from pem/der/asn sequences HOT 1
- Alg optional member Readme HOT 5
- Yeah steady stay
- 50
- 100 HOT 2
- How should I verify JWS with x5c certs with no CRL? HOT 6
- جدة
- JWT not being signed HOT 2
- Deprecation warning for invalid base64 should only be issued if fixed base64 is valid HOT 2
- شارع الربعين HOT 5
- H
- eyJhbGciOiJub25lIn0.eyJhZGRyZXNzIjp7InppcGNvZGUiOm51bGwsInN0cmVldG5vIjpudWxsLCJjaXR5IjoiQUwtQUZMQUciLCJzdHJlZXQiOm51bGx9LCJ0b2tlblVVSUQiOiI3Zjk1Yzc0ZDA3Y2M0OGI1OWNlNzhlYzBlZTU.
- T
- ExpiredSignature should perhaps not be a subclass of DecodeError HOT 2
- 1500 HOT 2
- غبيرا
- سحب
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ruby-jwt.