From aa3a094447d152ebd077cd181a242635e3678cad Mon Sep 17 00:00:00 2001 From: Tom Wallroth Date: Tue, 26 Feb 2019 13:47:33 +0100 Subject: [PATCH 1/4] added setting JWT_PUBLIC_KEY_USING_HEADER_HANDLER to dynamically fetch public keys based on the header when setting an import path to a callable into JWT_PUBLIC_KEY_USING_HEADER_HANDLER, it will be called with the JWT header as parameter. This allows to e.g. fetch dynamically changing certificates, like google does it for example --- rest_framework_jwt/settings.py | 4 ++++ rest_framework_jwt/utils.py | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/rest_framework_jwt/settings.py b/rest_framework_jwt/settings.py index e47320bb..add19283 100644 --- a/rest_framework_jwt/settings.py +++ b/rest_framework_jwt/settings.py @@ -25,6 +25,9 @@ 'JWT_PUBLIC_KEY': None, + 'JWT_PUBLIC_KEY_USING_HEADER_HANDLER': + None, + 'JWT_PAYLOAD_GET_USERNAME_HANDLER': 'rest_framework_jwt.utils.jwt_get_username_from_payload_handler', @@ -53,6 +56,7 @@ 'JWT_ENCODE_HANDLER', 'JWT_DECODE_HANDLER', 'JWT_PAYLOAD_HANDLER', + 'JWT_PUBLIC_KEY_USING_HEADER_HANDLER', 'JWT_PAYLOAD_GET_USER_ID_HANDLER', 'JWT_PAYLOAD_GET_USERNAME_HANDLER', 'JWT_RESPONSE_PAYLOAD_HANDLER', diff --git a/rest_framework_jwt/utils.py b/rest_framework_jwt/utils.py index c72197bc..f6b8b8da 100644 --- a/rest_framework_jwt/utils.py +++ b/rest_framework_jwt/utils.py @@ -102,10 +102,14 @@ def jwt_decode_handler(token): } # get user from token, BEFORE verification, to get user secret key unverified_payload = jwt.decode(token, None, False) + unverified_header = jwt.get_unverified_header(token) secret_key = jwt_get_secret_key(unverified_payload) + public_key = None + if api_settings.JWT_PUBLIC_KEY_USING_HEADER_HANDLER: + public_key = api_settings.JWT_PUBLIC_KEY_USING_HEADER_HANDLER(unverified_header) return jwt.decode( token, - api_settings.JWT_PUBLIC_KEY or secret_key, + public_key or api_settings.JWT_PUBLIC_KEY or secret_key, api_settings.JWT_VERIFY, options=options, leeway=api_settings.JWT_LEEWAY, From 9ef21a3d964443affa70603c51f56ea3e1ca27d3 Mon Sep 17 00:00:00 2001 From: Tom Wallroth Date: Tue, 26 Feb 2019 14:47:33 +0100 Subject: [PATCH 2/4] fixed reloading the JWT_AUTH settings, added support for @override_settings decorator for tests By fixing the settings being clobbered by the original APISettings implementation of restframework, we can now listen to settings changes using the `setting_changed` signal. This signal is used by the @override_settings decorator. This means that you can now perform tests that would for example override the JWT_VERIFY_EXPIRATION setting, allowing for testing without generating new tokens on the fly. --- rest_framework_jwt/settings.py | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/rest_framework_jwt/settings.py b/rest_framework_jwt/settings.py index add19283..ab4d57c5 100644 --- a/rest_framework_jwt/settings.py +++ b/rest_framework_jwt/settings.py @@ -1,6 +1,8 @@ import datetime from django.conf import settings +from django.core.signals import setting_changed + from rest_framework.settings import APISettings @@ -63,4 +65,24 @@ 'JWT_GET_USER_SECRET_KEY', ) -api_settings = APISettings(USER_SETTINGS, DEFAULTS, IMPORT_STRINGS) +class JWTAPISettings(APISettings): + # we need to override the `user_settings` as calling reload would otherwise load the + # `settings.REST_FRAMEWORK` into the JWT settings! + + @property + def user_settings(self): + if not hasattr(self, '_user_settings'): + self._user_settings = getattr(settings, 'JWT_AUTH', {}) + return self._user_settings + + +api_settings = JWTAPISettings(USER_SETTINGS, DEFAULTS, IMPORT_STRINGS) + + +def reload_api_settings(*args, **kwargs): + setting = kwargs['setting'] + if setting == 'JWT_AUTH': + api_settings.reload() + + +setting_changed.connect(reload_api_settings) From c667c854abe7a211076b2a8a26d2bbd8613dc7f0 Mon Sep 17 00:00:00 2001 From: Kwadjo Nyante <61976215+harpazo64@users.noreply.github.com> Date: Wed, 1 Sep 2021 22:14:38 +0200 Subject: [PATCH 3/4] Create codeql-analysis.yml security code-scanning --- .github/workflows/codeql-analysis.yml | 71 +++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/codeql-analysis.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 00000000..9d2f19f0 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,71 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '0 0 * * *' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'python' ] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] + # Learn more: + # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v1 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + queries: security-extended # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + # - name: Autobuild + # uses: github/codeql-action/autobuild@v1 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + #- run: | + # make bootstrap + # make release + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v1 From 8cd6175c35faa31465099ac376e067c3018ee003 Mon Sep 17 00:00:00 2001 From: "igor.mursa" Date: Tue, 6 Dec 2022 17:18:32 +0100 Subject: [PATCH 4/4] Remove PyJWT version constraint --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index bd2d31fa..d3f2151a 100644 --- a/setup.py +++ b/setup.py @@ -27,7 +27,7 @@ def get_version(package): author_email = 'jpadilla@getblimp.com' license = 'MIT' install_requires = [ - 'PyJWT>=1.5.2,<2.0.0', + 'PyJWT>=1.5.2', ]