go-kit/kit

ErrSignatureInvalid from jwt-go lib should be handled by jwt parser

Open

#947 建立於 2020年1月10日

在 GitHub 查看
 (1 留言) (0 反應) (0 負責人)Go (27,422 star) (2,446 fork)batch import
help wanted

描述

I'm playing around with jwt errors handling and I found out that there is a HS256-specific error in jwt-go library that is returned as inner error by the go-kit parser. I believe that this error should be handled by the parser and ErrTokenInvalid should be returned.

Any thoughts?

貢獻者指南

技術棧
go
領域
apisecurity
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-3 hours
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Go basicsjwt go library
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
60
研究方向
Look at the go kit JWT parser in `transport/http/jwt` or similar package. The issue points out that `ErrSignatureInvalid` from the jwt go library is not handled, causing the parser to return the raw inner error instead of `ErrTokenInvalid`. The fix involves catching that specific error in the parser code and converting it. Refer to the linked line in jwt go's hmac.go for the error definition.
ErrSignatureInvalid from jwt-go lib should be handled by jwt parser · go-kit/kit#947 | Good First Issue