feat: add jwt_signature_pk_urls to state
#866
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
esaminu
changed the title
jwt_signature_pk_urls to state
volovyks
reviewed
Sep 30, 2024
Collaborator
volovyks
left a comment
volovyks
left a comment
There was a problem hiding this comment.
Looks good overall. I have concerns about security in the process of token verification.
Let's sync and discuss this.
mpc-recovery/src/oauth.rs
Outdated
| let json: HashMap<String, String> = response.json().await?; | ||
| Ok(json.into_values().collect()) | ||
| jwt_signature_pk_urls: &[String], | ||
| ) -> Result<Vec<String>> { |
Collaborator
There was a problem hiding this comment.
It is better to create a map of keys: "provider" -> "[keys]".
Otherwise, somebody will create a token using provider1, but verify it with key 2.
volovyks
reviewed
Oct 2, 2024
| } | ||
|
|
||
| // NOTE: code taken directly from our implementation of token.decode but without the verification step | ||
| pub fn decode_unverified(&self) -> anyhow::Result<(jwt::Header, IdTokenClaims, String)> { |
| } | ||
| } | ||
|
|
||
| fn parse_jwks_format(obj: &serde_json::Map<String, Value>) -> Result<Vec<String>> { |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR:
jwt_signature_pk_urlfromSignNodeStateandLeadeStatewithjwt_signature_pk_urlsas comma separated listget_public_keysto fetch and handle public key responses with both firebase format and standard jwks format e.g. googleThe purpose is to add support to mpc for non firebase issuers e.g. google, apple etc. When a new issuer is added we need to ensure their public keys are also being fetched by appending their jwks url to this new env