* fix(alcoholic_jwt): Support multiple values in jwt audience claim
@ 2020-07-06 10:47 Caranatar
0 siblings, 0 replies; only message in thread
From: Caranatar @ 2020-07-06 10:47 UTC (permalink / raw)
To: depot
[-- Attachment #1: Type: text/plain, Size: 324 bytes --]
See attached patch file.
Open to a different approach for the Audience Validation, but I figured
it was the behavior I'd want. Also didn't add any tests because frankly
I'm not sure how to, but I did test against the JWT token that led me to
discover the issue, and it worked :)
-Caranatar
--
sent from emacs using mu4e
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: patch --]
[-- Type: text/x-patch, Size: 1957 bytes --]
From 8b1488d36510265ff453512dbe00a5f299d6e104 Mon Sep 17 00:00:00 2001
From: Caranatar <caranatar@riseup•net>
Date: Mon, 6 Jul 2020 06:36:35 -0400
Subject: [PATCH] fix(alcoholic_jwt): Support multiple values in jwt audience
claim
Per https://tools.ietf.org/html/rfc7519#section-4.1.3, the audience
claim can consist of either a single string or an array of strings.
The latter currently causes an error due to the type of aud in
PartialClaims.
---
net/alcoholic_jwt/src/lib.rs | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/alcoholic_jwt/src/lib.rs b/net/alcoholic_jwt/src/lib.rs
index c98bee615..4acd8d1e9 100644
--- a/net/alcoholic_jwt/src/lib.rs
+++ b/net/alcoholic_jwt/src/lib.rs
@@ -356,11 +356,20 @@ fn validate_jwt_signature(jwt: &JWT, key: Rsa<Public>) -> JWTResult<()> {
}
}
+/// Internal helper enum for PartialClaims that supports single or
+/// multiple audiences
+#[derive(Deserialize)]
+#[serde(untagged)]
+enum Audience {
+ Single(String),
+ Multi(Vec<String>)
+}
+
/// Internal helper struct for claims that are relevant for claim
/// validations.
#[derive(Deserialize)]
struct PartialClaims {
- aud: Option<String>,
+ aud: Option<Audience>,
iss: Option<String>,
sub: Option<String>,
exp: Option<u64>,
@@ -388,7 +397,12 @@ fn apply_validation(claims: &PartialClaims,
Validation::Audience(aud) => {
match claims.aud {
None => Err("'aud' claim is missing"),
- Some(ref claim) => if *claim == aud {
+ Some(Audience::Single(ref claim)) => if *claim == aud {
+ Ok(())
+ } else {
+ Err("'aud' claim does not match")
+ },
+ Some(Audience::Multi(ref claims)) => if claims.contains(&aud) {
Ok(())
} else {
Err("'aud' claim does not match")
--
2.27.0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-07-06 10:47 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-06 10:47 fix(alcoholic_jwt): Support multiple values in jwt audience claim Caranatar
Code repositories for project(s) associated with this public inbox
https://code.tvl.fyi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).