You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
First, thank you for all your work on this library! 🙇
We are implementing RFC9068 and during that we found the following issue: the JWT header's typ parameter is implicitly set to "JWT" inside token.go by the the unsignedToken function. Also the ToMap function filters out the typ as well and unfortunately it cannot be changed from the Session for example. And based on https://datatracker.ietf.org/doc/html/rfc9068#section-2.1-3 the typ must be set to at+jwt.
This PR adds the ability to set the typ parameter from the jwt.Headers and when the typ is not set explicitly then the typ will be set to "JWT".
I confirm that this pull request does not address a security vulnerability.
If this pull request addresses a security vulnerability,
I confirm that I got approval (please contact security@ory.sh) from the maintainers to push the changes.
I have added tests that prove my fix is effective or that my feature works.
I have added the necessary documentation within the code base (if appropriate).
Thank you for the PR! This looks quite good to me :) Unfortunately, OIDC Conformity tests are failing. I think they are also failing on master, but given this change we need them to be green. I'll spend a bit of time to see if I can fix this on master but if not, merging this PR is blocked by that requirement :(
Thank you for the PR! This looks quite good to me :) Unfortunately, OIDC Conformity tests are failing. I think they are also failing on master, but given this change we need them to be green. I'll spend a bit of time to see if I can fix this on master but if not, merging this PR is blocked by that requirement :(
@aeneasr, is there anything I could do/assist with to fix the failing oidc-conformity tests?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First, thank you for all your work on this library! 🙇
We are implementing RFC9068 and during that we found the following issue: the JWT header's
typparameter is implicitly set to "JWT" inside token.go by the theunsignedTokenfunction. Also theToMapfunction filters out thetypas well and unfortunately it cannot be changed from the Session for example. And based on https://datatracker.ietf.org/doc/html/rfc9068#section-2.1-3 thetypmust be set toat+jwt.This PR adds the ability to set the
typparameter from thejwt.Headersand when thetypis not set explicitly then thetypwill be set to "JWT".Checklist
If this pull request addresses a security vulnerability,
I confirm that I got approval (please contact security@ory.sh) from the maintainers to push the changes.
Further comments