nicoeri/filebrowser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adhere to jwt/v4 security recommendation: "validate the alg presented is what you expect"

Browse Source
This commit is contained in:
jake-dog 2025-05-13 21:10:24 -04:00
parent 07fe90ff5f
commit 6e6beab914
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
http/auth.go
View File

@ -87,7 +87,8 @@ func withUser(fn handleFunc) handleFunc {
}
var tk authToken
token, err := request.ParseFromRequest(r, &extractor{}, keyFunc, request.WithClaims(&tk))
p := jwt.NewParser(jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}))
token, err := request.ParseFromRequest(r, &extractor{}, keyFunc, request.WithClaims(&tk), request.WithParser(p))
if (err != nil || !token.Valid) && !renewableErr(err, d) {
return http.StatusUnauthorized, nil