Comments (14)
@karelbilek For completeness' sake, when you say "This should work", what are you expecting it to do, and what is it doing instead?
from jwx.
Well, you can see how the other library does it.
In case you didn't notice, I wrote this library because I don't agree with many of the decisions that "other" libraries made (with all due respect to their efforts), so I need to think this over. In general I don't think that "none" should be allowed at all, but I'm trying to think of a compromise.
from jwx.
@karelbilek FYI In branch gh-888, I've implemented a jws.Sign()
that allows generating JWS with alg=none. However, before merging or releasing, I need to think of how to handle it in jws.Verify()
(or not) as well as how to document it.
Note to self: need to test for the case where jws.WithInsecureNoSignature()
and jwt.WithKey
are used at the same time
from jwx.
@karelbilek after a bit of tinkering, I think the correct way is:
- Allow signing with alg=none, when passed with an explicit option
- DO NOT allow alg=none in verification
- Ask the user to use jws.Parse if they really want to accept messages with alg=none
Please see #890 and let me know
from jwx.
Note, I haven't reviewed the code yet, but my immediate thought is probably this should just return an error.
if _, err := jwt.Sign(token, jwt.WithKey(jwa.NoSignature, nil)); err != nil {
panic(err) // should get here
}
Is this what you want?
from jwx.
I want to create a JWT token with alg "none".
This should not return an error.
I will show an example later.
from jwx.
Oh, you actually want a "none"... Okay, I think I made it so that it refuses to do it. Anyways, an isolated test case would be nice just to make sure we're talking about exactly the same thing.
from jwx.
expected:
package main
import (
"fmt"
"github.com/lestrrat-go/jwx/v2/jwa"
"github.com/lestrrat-go/jwx/v2/jwt"
)
func main() {
token := jwt.New()
token.Set(jwt.SubjectKey, "foo")
token.Set(jwt.IssuerKey, "bar")
signed, err := jwt.Sign(token, jwt.WithKey(jwa.NoSignature, nil))
if err != nil {
panic(err)
}
// output: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJiYXIiLCJzdWIiOiJiYXIifQ.
fmt.Printf("%s", signed)
}
Comparison with golang-jwt:
package main
import (
"fmt"
golangJWT "github.com/golang-jwt/jwt/v4"
)
func main() {
token := golangJWT.NewWithClaims(golangJWT.SigningMethodNone, golangJWT.MapClaims{
"sub": "bar",
"iss": "bar",
})
signed, err := token.SignedString(golangJWT.UnsafeAllowNoneSignatureType)
if err != nil {
panic(err)
}
fmt.Printf("%s", signed)
}
from jwx.
Right, okay. We just don't allow "none". Let me get back to you in a few days, as I need to make up my mind on how/if I want to allow "none". Off the top of my head, I think if we allow the use of "none" it must be made a special case that requires an explicit opt-in like an extra option argument. But I need to think over what the best way is.
from jwx.
Well, you can see how the other library does it.
The main reason why I want this is to write some tests against code that it really doesn't allow "none", that's all.
from jwx.
Option 1: extra option
jwt.Sign(token, jwt.WithKey(jwa.NoSignature, nil), jwt.WithAllowNone(true))
pros: explicit, minimal change to API
cons: there's no way to check if the "none" algo slipped in by mistake
Option 2: special option
jwt.Sign(token, jwt.WithNoSignature())
pros: very explicit.
cons: new API
Option 3: New function
jwt.SignNone(token)
pros: very very explicit
cons: new API
from jwx.
(These are just my notes, please ignore)
- A new signer object for "none" is required.
jws.Verify
should mirror the behavior ofjws.Sign
wrt to "none" algorithm- A separate, explicit option is probably better API wise.
- We should return an error when we find the use of "none" with jws.WithKey
Unfortunately, this probably doesn't work?
jws.Verify(jwsmsg, jws.WithInsecureNoneAlgorithm())
This breaks when alg = "none" and jws.WithKeyUsed is passed? Could be a documented behavior, but seems a bit confusing... error out when that happens? Also, what happens when jws.WithKey or jws.WithKeyProvider is passed along with jws.WithInsecureNoneAlgorithm? which one takes precedence?
Also, what should happen for JWS messages with multiple signatures, which include "none"?
from jwx.
minor note: the original test code said it expected eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJiYXIiLCJzdWIiOiJiYXIifQ.
, but that payload is {"sub": "bar", "iss": "bar"}
, whereas the code produced {"sub":"foo", "iss":"bar"}
from jwx.
Perfect!
from jwx.
Related Issues (20)
- Ability to get `err` status from CachedSet HOT 14
- Problem when adding JWK in JWT Headers HOT 4
- Per Token FlatAudience Option HOT 7
- go 1.19 `panic` due to missing EC key validation HOT 4
- Confusing error when processing JWT with trailing garbage. HOT 4
- The order of selecting correct key to verify signature HOT 2
- Cannot parse key claim as jwk.Key HOT 4
- [v3] Allow "parser" to be registered in internal/json.Registry (i.e. `RegisterCustomField`) HOT 2
- Support bazel HOT 7
- jwk.EncodePEM, jwk.DecodePEM not reciprocal for ECDSA private keys HOT 2
- Missing `alg` in Key(Set) HOT 3
- Cannot remove typ header HOT 2
- JWT is not verified by JWKS if `alg` field is not present HOT 3
- jws.KeyProvider in relation to jws.Sign HOT 1
- jws.Sign does not support a custom signer with an algorithm that does not exist in allSignatureAlgorithms. HOT 7
- Expose Registering new JWK types HOT 10
- [v3] Errors getting swallowed by JWK cache HOT 3
- OpaqueKeyDecrypter for JWE HOT 11
- Provide a way to shutdown http cache fetcher to avoid go-routine leaks. HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jwx.