Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Commit

Permalink
Clarify the string split while manually parsing the JWT
Browse files Browse the repository at this point in the history
  • Loading branch information
sandhose committed Oct 31, 2022
1 parent 9cc5d40 commit 1614e02
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions synapse/handlers/oidc.py
Expand Up @@ -292,8 +292,10 @@ async def handle_backchannel_logout(self, request: SynapseRequest) -> None:
# The aud and iss claims we care about are in the payload part, which
# is a JSON object.
try:
# This raises if there are too many or not enough segments in the token
_, payload, _ = logout_token.rsplit(".", 4)
# By splitting a maximum of 3 times and destructuring the resulting array,
# we ensure that we have exactly 3 segments, and without doing unnecessary
# splits.
_, payload, _ = logout_token.rsplit(".", 3)
except ValueError:
raise SynapseError(400, "Invalid logout_token in request")

Expand Down

0 comments on commit 1614e02

Please sign in to comment.