Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NullPointerException when checking empty audience #674

Closed
5 tasks done
viapivov opened this issue Oct 23, 2023 · 2 comments · Fixed by #679
Closed
5 tasks done

NullPointerException when checking empty audience #674

viapivov opened this issue Oct 23, 2023 · 2 comments · Fixed by #679
Labels
bug This points to a verified bug in the code

Comments

@viapivov
Copy link

Checklist

  • I have looked into the Readme and Examples, and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Description

We've encountered a bug in 4.4.0 when checking if the token is issued for audience that in some cases may be empty. It used to work with 3.19.4.

Here's a snippet to reproduce it.

    @Test
    public void testEmptyAudJwtClaim() {
        String[] allowedAudience = new String[0];
        String token = JWT.create().withAudience("wide audience").sign(Algorithm.HMAC256("secret"));

        JWTVerifier verifier = JWT.require(Algorithm.HMAC256("secret")).withAudience(allowedAudience).build();
        
        verifier.verify(token);
    }

The workaround we've found is to exclude withAudience check in case if audience is empty.

Reproduction

  1. Claim token
  2. Include check with empty audience
  3. Verify the token to include all the audience

Additional context

No response

java-jwt version

4.4.0

Java version

11

@viapivov viapivov added the bug This points to a verified bug in the code label Oct 23, 2023
@jimmyjames
Copy link
Contributor

Thanks @viapivov for raising and providing a reproducible test; we'll look into this and get a fix out if there is an update needed for the SDK.

@jimmyjames
Copy link
Contributor

In this case, the validation should fail when expecting a zero-length string array audience claim value; but not with a NullPointerException as it is currently. We'll get a fix in to throw an IncorrectClaimException instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This points to a verified bug in the code
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants