Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Test Case for KID Injection #26

Open
Merenon opened this issue Apr 9, 2020 · 0 comments
Open

Add Test Case for KID Injection #26

Merenon opened this issue Apr 9, 2020 · 0 comments

Comments

@Merenon
Copy link
Contributor

Merenon commented Apr 9, 2020

4.1.4. "kid" (Key ID) Header Parameter
The "kid" (key ID) Header Parameter is a hint indicating which key
was used to secure the JWS. This parameter allows originators to
explicitly signal a change of key to recipients. The structure of
the "kid" value is unspecified. Its value MUST be a case-sensitive
string. Use of this Header Parameter is OPTIONAL.
When used with a JWK, the "kid" value is used to match a JWK "kid"
parameter value.

The KID value might be used to retrieve the key from a database or the file system and might be vulnerable to injections.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant