status-im
/
spiff-arena
mirror of https://github.com/status-im/spiff-arena.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

do not validate the audience with the jwt decode since we have a more thorough check for it later w/ burnettk (#1109) 

Co-authored-by: jasquat <jasquat@users.noreply.github.com>
This commit is contained in:
jasquat 2024-02-26 14:12:36 -05:00 committed by GitHub
parent 13848e85e3
commit 80886b53bc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
spiffworkflow-backend/src/spiffworkflow_backend/services/authentication_service.py
View File

@ -99,7 +99,7 @@ class AuthenticationService:
@classmethod @classmethod
def valid_audiences(cls, authentication_identifier: str) -> list[str]: def valid_audiences(cls, authentication_identifier: str) -> list[str]:
return [cls.client_id(authentication_identifier)] return [cls.client_id(authentication_identifier), "account"]
@classmethod @classmethod
def server_url(cls, authentication_identifier: str) -> str: def server_url(cls, authentication_identifier: str) -> str:
@ -181,12 +181,17 @@ class AuthenticationService:
x509_cert = load_der_x509_certificate(decoded_certificate, default_backend()) x509_cert = load_der_x509_certificate(decoded_certificate, default_backend())
public_key = x509_cert.public_key() public_key = x509_cert.public_key()
# tokens generated from the cli have an aud like: [ "realm-management", "account" ]
# while tokens generated from frontend have an aud like: "spiffworkflow-backend."
# as such, we cannot simply pull the first valid audience out of cls.valid_audiences(authentication_identifier)
# and then shove it into decode (it will raise), but we need the algorithm from validate_decoded_token that checks
# if the audience in the token matches any of the valid audience values. Therefore do not check aud here.
return jwt.decode( return jwt.decode(
token, token,
public_key, public_key,
algorithms=[algorithm], algorithms=[algorithm],
audience=cls.valid_audiences(authentication_identifier)[0], audience=cls.valid_audiences(authentication_identifier)[0],
options={"verify_exp": False}, options={"verify_exp": False, "verify_aud": False},
) )
@staticmethod @staticmethod