bug: enforce VAPID aud
#225
Conversation
|
marked as draft until mozilla-services/autopush#1432 lands |
|
Adding directly to review queue since the source is bugzilla. |
| validate_vapid_jwt(vapid)?; | ||
| validate_vapid_jwt( | ||
| vapid, | ||
| &format!("{}://{}", &state.settings.scheme, &state.settings.host), |
There was a problem hiding this comment.
Can you include the non standard ports in here (like the python now does)? Otherwise I think a mismatch could potentially hit someone when testing vapid locally.
Might make sense to make the formatted version w/ port a var or method on Settings.
There was a problem hiding this comment.
Ah cool, we already have that method.
It does not hide the standard ports though, can we fix that here? Or making it a separate issue might make more sense in case it affects something else.
autopush already has logic for this.
There was a problem hiding this comment.
Oh, cool. Didn't know about that function.
I'll make a separate issue to fix that. #229
Issue: bug 1663922
Issue: bug 1663922
Note The failing python tests may be fixed by mozilla-services/autopush#1432