-
Notifications
You must be signed in to change notification settings - Fork 257
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a way to verify token signature #101
Comments
Anyone have any comment on this? |
@jmelberg-okta Sorry to pester you, but to me this issue seems more pressing than my other issue, since the id token signature is never validated. Do you have any thoughts on this one? |
I'm not sure of the historical reason as to why we're ignoring signature validation when receiving the Our team is auditing this library + making changes to ensure we have all the necessary ID Token Validation steps. Secondly, calling I'd be happy to take a look at a PR with these changes if you have time. Please make sure to review/sign our CLA beforehand. Thanks! |
Resolved with |
In lib/token.js on line 231 you are calling verifyToken as follows.
okta-auth-js/lib/token.js
Line 231 in c4906a2
That last value of true sets the variable 'ignoreSignature' to true, thereby skipping the validation of the jwt signature in the verifyToken function, which parseFromUrl uses indirectly (parseFromUrl -> handleOAuthResponse -> verifyToken) My first question is what is the reasoning for always ignoring the signature of the idToken? And my second question is would you be willing to make that configurable or open to a PR that would make it configurable?
Thanks!
The text was updated successfully, but these errors were encountered: