Buggy ECDSA implementation about jwt-cpp HOT 7 CLOSED

@jfinkhaeuser Of course it should be fixed to error out. But since this is not a hard bug I will fix it once I come around to do so and consider it an improvement.

from jwt-cpp.

@jfinkhaeuser
I believe it should no behave correctly. You may check over it though.

from jwt-cpp.

Sorry for the late reply.
If I understand correctly, the "bug" is that the library does not protect you against using the wrong input key ?
Or is there also an issue if you use it correctly ?

from jwt-cpp.

The bug is in the invalid padding. The trigger are the mismatching keys.

from jwt-cpp.

Yeah but the bug regarding invalid padding was fixed in the other issue. So this is only about it not complaining about the user doing something wrong?

from jwt-cpp.

The code or the documentation.

I'm not trying to tell you what you should do, mind you. But I also have a quality management background, and my preference is that invalid inputs should not look like they succeed. Currently that's the case.

Personal preference would be to error out and document how to avoid it.

from jwt-cpp.

Behaviour should be fixed by fae2875.

from jwt-cpp.