fix: sanitize tokens for the blacklist #352
Conversation
| @@ -89,6 +89,7 @@ defmodule SupavisorWeb.Router do | |||
| blocklist = Application.fetch_env!(:supavisor, blocklist_key) | |||
|
|
|||
| with ["Bearer " <> token] <- get_req_header(conn, "authorization"), | |||
| token <- Regex.replace(~r/\s|\n/, URI.decode(token), ""), | |||
There was a problem hiding this comment.
why not
blocklist =
Application.get_env(:realtime, blocklist_key, [])
|> Enum.map(&String.trim/1)
|> Enum.map(&String.downcase/1)
There was a problem hiding this comment.
I repeated the same approach as in JwtAuthToken to ensure we manipulate the same string
There was a problem hiding this comment.
supavisor/lib/supavisor/jwt.ex
Line 39 in d6897df
There was a problem hiding this comment.
but why URI decode it? really curious about it.
There was a problem hiding this comment.
you can hide some symbols via HTML characters, which token sanitization can skip but the JWT library can decode
There was a problem hiding this comment.
TIL 👀 will copy pasta it into realtime 🍝
There was a problem hiding this comment.
should we do the same to the blocklist tokens?
There was a problem hiding this comment.
I guess not, because we can check that they are without spaces or new lines?
No description provided.