Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

when building a JWK verifier, the alg field should be optional. #434

Closed
mkporwit opened this issue Jun 7, 2018 · 1 comment
Closed

when building a JWK verifier, the alg field should be optional. #434

mkporwit opened this issue Jun 7, 2018 · 1 comment

Comments

@mkporwit
Copy link
Contributor

mkporwit commented Jun 7, 2018

The JWK RFC (https://tools.ietf.org/html/rfc7517#section-4.4) specifies that the alg parameter is optional. However, JWTAuth.kt:getVerifier() throws a "java.lang.IllegalArgumentException: Unsupported algorithm null" when it tries to parse JWKS that do not define one (such as those at https://login.microsoftonline.com/common/discovery/v2.0/keys)

A proposed fix would be to either peek at the JWT and use the same algorithm as the JWT is signed with, or just default to RS256 if nothing is defined. That latter approach was taken by Spring, here: spring-attic/spring-security-oauth@9b7d576
mkporwit pushed a commit to mkporwit/ktor that referenced this issue Jun 7, 2018
default to RS256 as the algorithm if the JWK does not optionally prov…
cfac762 
…ide one (ktorio#434)
cy6erGn0m pushed a commit that referenced this issue Jun 25, 2018
@mkporwit @cy6erGn0m
JWK: Use RSA256 if JWK does not provide one (#434) (#435)
8a0ab75 
* default to RS256 as the algorithm if the JWK does not optionally provide one (#434)
* add test case for null algorithm, ensure tests use jwk.makeAlgorithm from src
@mkporwit
Copy link
Contributor Author

Fix has been merged into master and released in 0.9.3. Closing this issue.

schleinzer pushed a commit to schleinzer/ktor that referenced this issue Feb 26, 2019
@mkporwit
JWK: Use RSA256 if JWK does not provide one (ktorio#434) (ktorio#435)
e300cb7 
* default to RS256 as the algorithm if the JWK does not optionally provide one (ktorio#434)
* add test case for null algorithm, ensure tests use jwk.makeAlgorithm from src
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@mkporwit