Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verify validIssuers without taking into account the trailing slash #14

Open
maxceem opened this issue Sep 19, 2018 · 0 comments
Open

Verify validIssuers without taking into account the trailing slash #14

maxceem opened this issue Sep 19, 2018 · 0 comments

Comments

@maxceem
Copy link

maxceem commented Sep 19, 2018

Currently, if we define validIssuers=['https://topcoder-newauth.auth0.com'] while inside tokeniss="https://topcoder-newauth.auth0.com/" the issuer verification will fail. Because in validIssuers we defined URL without trailing slash, while inside token iss is defined as URL with trailing slash.

Also, probably possbile the reverse situation, when iss will be defined without trailing slash, and validIssuers will be defined with trailing slash.

When tc-core-library-js is used as dependency of other service it could be hard to understand where issues comes from as it could be not clear from the first sight why verification failed if URL looks same. I think it would be nice to enhance the verification process so it ignores the trailing slash. So far I don't see security issues if such enhancements is implemented.

Lines where we verify validIssuers:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant