Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make TJWS.CheckCompactToken more strict #65

Closed
havrlisan opened this issue Mar 16, 2023 · 1 comment
Closed

Make TJWS.CheckCompactToken more strict #65

havrlisan opened this issue Mar 16, 2023 · 1 comment

Comments

@havrlisan
Copy link

havrlisan commented Mar 16, 2023

Hi. I noticed your code in TJWS.CheckCompactToken is rather simple, where you check if the given string contains 3 non-empty parts separated by a dot. While this might be sufficient for most cases, it could be more strict in a way that you try to parse the Header and Claims (Payload) section to a JSON value. For example:

class function TJWS.CheckCompactToken(const Value: TJOSEBytes; const AStrict: Boolean): Boolean;
var
  LRes: TStringDynArray;
  LIndex: Integer;
begin
  Result := True;

  if Value.IsEmpty then
    Exit(False);

  LRes := SplitString(Value, PART_SEPARATOR);
  if not (Length(LRes) = COMPACT_PARTS) then
    Exit(False);

  for LIndex := 0 to Length(LRes) - 1 do
  begin
    if LRes[LIndex].IsEmpty then
      Exit(False);
  end;
  
  if TJSONObject.ParseJSONValue(LRes[0]) = nil then
    Exit(False);
  if TJSONObject.ParseJSONValue(LRes[1]) = nil then
    Exit(False);
end;

Thanks for creating this library and writing such clean and readable code!

@paolo-rossi
Copy link
Owner

Hello @havrlisan

Yes, I knew that the check was not "strong" but I simply forgot to refactor this function, I like your solution... how about you create a PR so I can credit you for this work?

Paolo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants