Hawkin
/
arangodb
mirror of https://gitee.com/bigwinds/arangodb
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Bug fix 3.4/jwt base64url encoded (#7904) 

* Use base64url encoding and decoding for jwt header and body as specified in the rfc.

* Added changelog.
This commit is contained in:
Lars Maier 2019-01-08 16:55:17 +01:00 committed by Max Neunhöffer
parent 9c099ba5da
commit bc9f9ed14d
2 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG
View File

@ -1,6 +1,8 @@
v3.4.2 (XXXX-XX-XX) v3.4.2 (XXXX-XX-XX)
------------------- -------------------
* Use base64url to encode and decode JWT parts.
* added AQL function `CHECK_DOCUMENT` for document validity checks * added AQL function `CHECK_DOCUMENT` for document validity checks
* when detecting parse errors in the JSON input sent to the restore API, now * when detecting parse errors in the JSON input sent to the restore API, now

8
arangod/Auth/TokenCache.cpp
View File

@ -252,7 +252,7 @@ std::shared_ptr<VPackBuilder> auth::TokenCache::parseJson(std::string const& str
bool auth::TokenCache::validateJwtHeader(std::string const& header) { bool auth::TokenCache::validateJwtHeader(std::string const& header) {
std::shared_ptr<VPackBuilder> headerBuilder = std::shared_ptr<VPackBuilder> headerBuilder =
parseJson(StringUtils::decodeBase64(header), "jwt header"); parseJson(StringUtils::decodeBase64U(header), "jwt header");
if (headerBuilder.get() == nullptr) { if (headerBuilder.get() == nullptr) {
return false; return false;
} }
@ -287,7 +287,7 @@ bool auth::TokenCache::validateJwtHeader(std::string const& header) {
auth::TokenCache::Entry auth::TokenCache::validateJwtBody(std::string const& body) { auth::TokenCache::Entry auth::TokenCache::validateJwtBody(std::string const& body) {
std::shared_ptr<VPackBuilder> bodyBuilder = std::shared_ptr<VPackBuilder> bodyBuilder =
parseJson(StringUtils::decodeBase64(body), "jwt body"); parseJson(StringUtils::decodeBase64U(body), "jwt body");
if (bodyBuilder.get() == nullptr) { if (bodyBuilder.get() == nullptr) {
LOG_TOPIC(TRACE, Logger::AUTHENTICATION) << "invalid JWT body"; LOG_TOPIC(TRACE, Logger::AUTHENTICATION) << "invalid JWT body";
return auth::TokenCache::Entry::Unauthenticated(); return auth::TokenCache::Entry::Unauthenticated();
@ -369,8 +369,8 @@ std::string auth::TokenCache::generateRawJwt(VPackSlice const& body) const {
headerBuilder.add("typ", VPackValue("JWT")); headerBuilder.add("typ", VPackValue("JWT"));
} }
std::string fullMessage(StringUtils::encodeBase64(headerBuilder.toJson()) + std::string fullMessage(StringUtils::encodeBase64U(headerBuilder.toJson()) +
"." + StringUtils::encodeBase64(body.toJson())); "." + StringUtils::encodeBase64U(body.toJson()));
if (_jwtSecret.empty()) { if (_jwtSecret.empty()) {
LOG_TOPIC(INFO, Logger::AUTHENTICATION) LOG_TOPIC(INFO, Logger::AUTHENTICATION)
<< "Using cluster without JWT Token"; << "Using cluster without JWT Token";