From: Caranatar <caranatar@riseup•net>
To: depot@tazj.in
Subject: fix(alcoholic_jwt): Support multiple values in jwt audience claim
Date: Mon, 06 Jul 2020 06:47:20 -0400 [thread overview]
Message-ID: <87r1toex8n.fsf@riseup.net> (raw)
[-- Attachment #1: Type: text/plain, Size: 324 bytes --]
See attached patch file.
Open to a different approach for the Audience Validation, but I figured
it was the behavior I'd want. Also didn't add any tests because frankly
I'm not sure how to, but I did test against the JWT token that led me to
discover the issue, and it worked :)
-Caranatar
--
sent from emacs using mu4e
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: patch --]
[-- Type: text/x-patch, Size: 1957 bytes --]
From 8b1488d36510265ff453512dbe00a5f299d6e104 Mon Sep 17 00:00:00 2001
From: Caranatar <caranatar@riseup•net>
Date: Mon, 6 Jul 2020 06:36:35 -0400
Subject: [PATCH] fix(alcoholic_jwt): Support multiple values in jwt audience
claim
Per https://tools.ietf.org/html/rfc7519#section-4.1.3, the audience
claim can consist of either a single string or an array of strings.
The latter currently causes an error due to the type of aud in
PartialClaims.
---
net/alcoholic_jwt/src/lib.rs | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/alcoholic_jwt/src/lib.rs b/net/alcoholic_jwt/src/lib.rs
index c98bee615..4acd8d1e9 100644
--- a/net/alcoholic_jwt/src/lib.rs
+++ b/net/alcoholic_jwt/src/lib.rs
@@ -356,11 +356,20 @@ fn validate_jwt_signature(jwt: &JWT, key: Rsa<Public>) -> JWTResult<()> {
}
}
+/// Internal helper enum for PartialClaims that supports single or
+/// multiple audiences
+#[derive(Deserialize)]
+#[serde(untagged)]
+enum Audience {
+ Single(String),
+ Multi(Vec<String>)
+}
+
/// Internal helper struct for claims that are relevant for claim
/// validations.
#[derive(Deserialize)]
struct PartialClaims {
- aud: Option<String>,
+ aud: Option<Audience>,
iss: Option<String>,
sub: Option<String>,
exp: Option<u64>,
@@ -388,7 +397,12 @@ fn apply_validation(claims: &PartialClaims,
Validation::Audience(aud) => {
match claims.aud {
None => Err("'aud' claim is missing"),
- Some(ref claim) => if *claim == aud {
+ Some(Audience::Single(ref claim)) => if *claim == aud {
+ Ok(())
+ } else {
+ Err("'aud' claim does not match")
+ },
+ Some(Audience::Multi(ref claims)) => if claims.contains(&aud) {
Ok(())
} else {
Err("'aud' claim does not match")
--
2.27.0
reply other threads:[~2020-07-06 10:47 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87r1toex8n.fsf@riseup.net \
--to=caranatar@riseup$(echo .)net \
--cc=depot@tazj.in \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://code.tvl.fyi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).