Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ConjureUndertowRuntime logs exceptions for non-Palantir JWTs #1833

Open
gatesn opened this issue Jun 23, 2022 · 0 comments
Open

ConjureUndertowRuntime logs exceptions for non-Palantir JWTs #1833

gatesn opened this issue Jun 23, 2022 · 0 comments

Comments

@gatesn
Copy link

gatesn commented Jun 23, 2022

What happened?

ConjureUndertowRuntime configures a ConjureAuthorizationExtractor which optimistically calls UnverifiedJsonWebToken.tryParse to extract user information from an unverified token.

However, the Palantir auth-tokens project assumes Palantir's JWT format. Specifically, it tries to decode sub, sid and jti as base64-encoded UUIDs: https://github.com/palantir/auth-tokens/blob/bb668c6e99dd211799cbc4aa7602114b9d882368/auth-tokens/src/main/java/com/palantir/tokens/auth/UnverifiedJsonWebToken.java#L125-L128

When using Conjure with non-Palantir tokens, this fills the logs with parse exceptions (albeit not failing the request).

What did you want to happen?

The ConjureUndertowRuntime.Builder could allow the user to override the mechanism for extracting the userId, sessionId and tokenId from a BearerToken.

Happy to put up a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant