-
-
Notifications
You must be signed in to change notification settings - Fork 45
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: don't crash if none
is a supported request signing alg
#297
Conversation
Instead, catch the error and allow the upstream to fall back to a different approach. For the `oidcc_authorization` module, that means normal query parameters rather than a signed request object. In particular, I ran into this when calling `create_redirect_url` with a client ID and client secret (not `:unauthenticated`) when `none` is a supported request signing alg. This might be eliminating support for `none` signed request JWTs entirely, but it wasn't clear whether that's required for clients.
@paulswartz Thanks for the PR. I however believe that we should support none for What error did you get exactly? |
|
@paulswartz My initial plan was to support Looking at it now (also considering none id tokens only being valid in combination with a userinfo request) I'm not sure if this is a good solution. We should for sure catch this error. About allowing
|
(Don't know though how we would do option 2 without overriding the config globally at least while we sign a token, so that's probably not really feasible.) |
I agree on not overriding the global configuration; that doesn't seem like a safe option. @maennchen I added back the support, but handling the exception so that we'll still use the fallback path if |
Previously, it would return only two items: the first non-`none` algorithm, and `none`. This doesn't appear to be what we want: instead, we want the full list in their regular order, but with `none` at the end. Related to erlef#297, as the root cause of the crash I was seeing was the the first algorithm in the authorizer's list wasn't supported by JOSE, so we went immediately to `none`.
Previously, it would return only two items: the first non-`none` algorithm, and `none`. This doesn't appear to be what we want: instead, we want the full list in their regular order, but with `none` at the end. Related to #297, as the root cause of the crash I was seeing was the the first algorithm in the authorizer's list wasn't supported by JOSE, so we went immediately to `none`.
Instead, catch the error and allow the upstream to fall back to a different approach. For the
oidcc_authorization
module, that means normal query parameters rather than a signed request object.In particular, I ran into this when calling
create_redirect_url
with a client ID and client secret (not:unauthenticated
) whennone
is a supported request signing alg.This might be eliminating support for
none
signed request JWTs entirely, but it wasn't clear whether that's required for clients.