Skip to content

Commit d6e4bf0

Browse files
hzalazhzalaz
authored
Merge pull request auth0#57 from auth0/bugfix-verifier
Fix verifier bug for aud & iss
2 parents 111023b + 6732006 commit d6e4bf0

File tree

6 files changed

+125
-63
lines changed

6 files changed

+125
-63
lines changed

‎.travis.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
language: java
2+
jdk:
3+
- oraclejdk7
4+
branches:
5+
only:
6+
- master

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@
7373
<dependency>
7474
<groupId>junit</groupId>
7575
<artifactId>junit</artifactId>
76-
<version>4.11</version>
76+
<version>4.12</version>
7777
<scope>test</scope>
7878
</dependency>
7979

‎src/main/java/com/auth0/jwt/JWTAudienceException.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,11 @@ public class JWTAudienceException extends JWTVerifyException {
1414
private JsonNode audienceNode;
1515

1616
public JWTAudienceException(final JsonNode audienceNode) {
17-
Validate.notNull(audienceNode);
1817
this.audienceNode = audienceNode;
1918
}
2019

2120
public JWTAudienceException(final String message, final JsonNode audienceNode) {
2221
super(message);
23-
Validate.notNull(audienceNode);
2422
this.audienceNode = audienceNode;
2523
}
2624

‎src/main/java/com/auth0/jwt/JWTIssuerException.java‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
package com.auth0.jwt;
22

3-
import org.apache.commons.lang3.Validate;
4-
53
/**
64
* Represents Exception related to Issuer - for example issuer mismatch / missing upon verification
75
*/
@@ -10,13 +8,11 @@ public class JWTIssuerException extends JWTVerifyException {
108
private final String issuer;
119

1210
public JWTIssuerException(final String issuer) {
13-
Validate.notNull(issuer);
1411
this.issuer = issuer;
1512
}
1613

1714
public JWTIssuerException(final String message, final String issuer) {
1815
super(message);
19-
Validate.notNull(issuer);
2016
this.issuer = issuer;
2117
}
2218

‎src/main/java/com/auth0/jwt/JWTVerifier.java‎

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,9 @@ public JWTVerifier(final PublicKey publicKey) {
9494
* @throws JWTAlgorithmException when the algorithm is missing or unsupported
9595
* @throws IllegalStateException when token's structure is invalid or secret / public key does not match algorithm of token
9696
*/
97+
@SuppressWarnings("WeakerAccess")
9798
public Map<String, Object> verify(final String token) throws NoSuchAlgorithmException, InvalidKeyException, IllegalStateException,
98-
IOException, SignatureException, JWTVerifyException, JWTAlgorithmException {
99+
IOException, SignatureException, JWTVerifyException {
99100
if (token == null || "".equals(token)) {
100101
throw new IllegalStateException("token not set");
101102
}
@@ -113,7 +114,7 @@ public Map<String, Object> verify(final String token) throws NoSuchAlgorithmExce
113114
return mapper.treeToValue(jwtPayload, Map.class);
114115
}
115116

116-
protected void verifySignature(final String[] pieces, final Algorithm algorithm) throws NoSuchAlgorithmException,
117+
void verifySignature(final String[] pieces, final Algorithm algorithm) throws NoSuchAlgorithmException,
117118
InvalidKeyException, SignatureException, JWTAlgorithmException, IllegalStateException {
118119
Validate.notNull(pieces);
119120
Validate.notNull(algorithm);
@@ -136,24 +137,24 @@ protected void verifySignature(final String[] pieces, final Algorithm algorithm)
136137
}
137138
}
138139

139-
void verifyHmac(final Algorithm algorithm, final String[] pieces, final byte[] secret) throws SignatureException, NoSuchAlgorithmException, InvalidKeyException {
140+
private void verifyHmac(final Algorithm algorithm, final String[] pieces, final byte[] secret) throws SignatureException, NoSuchAlgorithmException, InvalidKeyException {
140141
if (secret == null || secret.length == 0) {
141142
throw new IllegalStateException("Secret cannot be null or empty when using algorithm: " + algorithm.getValue());
142143
}
143144
final Mac hmac = Mac.getInstance(algorithm.getValue());
144145
hmac.init(new SecretKeySpec(secret, algorithm.getValue()));
145-
final byte[] sig = hmac.doFinal(new StringBuilder(pieces[0]).append(".").append(pieces[1]).toString().getBytes());
146+
final byte[] sig = hmac.doFinal((pieces[0] + "." + pieces[1]).getBytes());
146147
if (!MessageDigest.isEqual(sig, decoder.decode(pieces[2]))) {
147148
throw new SignatureException("signature verification failed");
148149
}
149150
}
150151

151-
void verifyRs(final Algorithm algorithm, final String[] pieces, final PublicKey publicKey) throws SignatureException, NoSuchAlgorithmException, InvalidKeyException, JWTAlgorithmException {
152+
private void verifyRs(final Algorithm algorithm, final String[] pieces, final PublicKey publicKey) throws SignatureException, NoSuchAlgorithmException, InvalidKeyException, JWTAlgorithmException {
152153
if (publicKey == null) {
153154
throw new IllegalStateException("PublicKey cannot be null when using algorithm: " + algorithm.getValue());
154155
}
155156
final byte[] decodedSignatureBytes = new Base64(true).decode(pieces[2]);
156-
final byte[] headerPayloadBytes = new StringBuilder(pieces[0]).append(".").append(pieces[1]).toString().getBytes();
157+
final byte[] headerPayloadBytes = (pieces[0] + "." + pieces[1]).getBytes();
157158
final boolean verified = verifySignatureWithPublicKey(this.publicKey, headerPayloadBytes, decodedSignatureBytes, algorithm);
158159
if (!verified) {
159160
throw new SignatureException("signature verification failed");
@@ -175,42 +176,52 @@ private boolean verifySignatureWithPublicKey(final PublicKey publicKey, final by
175176
}
176177
}
177178

178-
protected void verifyExpiration(final JsonNode jwtClaims) throws JWTExpiredException {
179+
void verifyExpiration(final JsonNode jwtClaims) throws JWTExpiredException {
179180
Validate.notNull(jwtClaims);
180181
final long expiration = jwtClaims.has("exp") ? jwtClaims.get("exp").asLong(0) : 0;
181182
if (expiration != 0 && System.currentTimeMillis() / 1000L >= expiration) {
182183
throw new JWTExpiredException("jwt expired", expiration);
183184
}
184185
}
185186

186-
protected void verifyIssuer(final JsonNode jwtClaims) throws JWTIssuerException {
187+
void verifyIssuer(final JsonNode jwtClaims) throws JWTIssuerException {
187188
Validate.notNull(jwtClaims);
189+
190+
if (this.issuer == null ) {
191+
return;
192+
}
193+
188194
final String issuerFromToken = jwtClaims.has("iss") ? jwtClaims.get("iss").asText() : null;
189-
if (issuerFromToken != null && issuer != null && !issuer.equals(issuerFromToken)) {
195+
196+
if (issuerFromToken == null || !issuer.equals(issuerFromToken)) {
190197
throw new JWTIssuerException("jwt issuer invalid", issuerFromToken);
191198
}
192199
}
193200

194-
protected void verifyAudience(final JsonNode jwtClaims) throws JWTAudienceException {
201+
void verifyAudience(final JsonNode jwtClaims) throws JWTAudienceException {
195202
Validate.notNull(jwtClaims);
196-
if (audience == null)
203+
if (audience == null) {
197204
return;
205+
}
198206
final JsonNode audNode = jwtClaims.get("aud");
199-
if (audNode == null)
200-
return;
207+
if (audNode == null) {
208+
throw new JWTAudienceException("jwt audience invalid", null);
209+
}
201210
if (audNode.isArray()) {
202211
for (final JsonNode jsonNode : audNode) {
203-
if (audience.equals(jsonNode.textValue()))
212+
if (audience.equals(jsonNode.textValue())) {
204213
return;
214+
}
205215
}
206216
} else if (audNode.isTextual()) {
207-
if (audience.equals(audNode.textValue()))
217+
if (audience.equals(audNode.textValue())) {
208218
return;
219+
}
209220
}
210221
throw new JWTAudienceException("jwt audience invalid", audNode);
211222
}
212223

213-
protected Algorithm getAlgorithm(final JsonNode jwtHeader) throws JWTAlgorithmException {
224+
Algorithm getAlgorithm(final JsonNode jwtHeader) throws JWTAlgorithmException {
214225
Validate.notNull(jwtHeader);
215226
final String algorithmName = jwtHeader.has("alg") ? jwtHeader.get("alg").asText() : null;
216227
if (jwtHeader.get("alg") == null) {
@@ -219,11 +230,10 @@ protected Algorithm getAlgorithm(final JsonNode jwtHeader) throws JWTAlgorithmEx
219230
return Algorithm.findByName(algorithmName);
220231
}
221232

222-
protected JsonNode decodeAndParse(final String b64String) throws IOException {
233+
JsonNode decodeAndParse(final String b64String) throws IOException {
223234
Validate.notNull(b64String);
224235
final String jsonString = new String(decoder.decode(b64String), "UTF-8");
225-
final JsonNode jwtHeader = mapper.readValue(jsonString, JsonNode.class);
226-
return jwtHeader;
236+
return mapper.readValue(jsonString, JsonNode.class);
227237
}
228238

229239
}

0 commit comments

Comments
 (0)