go-kit/kit

ErrSignatureInvalid from jwt-go lib should be handled by jwt parser

Open

#947 创建于 2020年1月10日

在 GitHub 查看
 (1 评论) (0 反应) (0 负责人)Go (27,422 star) (2,446 fork)batch import
help wanted

描述

I'm playing around with jwt errors handling and I found out that there is a HS256-specific error in jwt-go library that is returned as inner error by the go-kit parser. I believe that this error should be handled by the parser and ErrTokenInvalid should be returned.

Any thoughts?

贡献者指南

技术栈
go
领域
apisecurity
议题类型
bug
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-3 hours
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
Go basicsjwt go library
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
60
研究方向
Look at the go kit JWT parser in `transport/http/jwt` or similar package. The issue points out that `ErrSignatureInvalid` from the jwt go library is not handled, causing the parser to return the raw inner error instead of `ErrTokenInvalid`. The fix involves catching that specific error in the parser code and converting it. Refer to the linked line in jwt go's hmac.go for the error definition.
ErrSignatureInvalid from jwt-go lib should be handled by jwt parser · go-kit/kit#947 | Good First Issue