dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Reject none algorithm when checking JWT signature (#1835)

Browse Source
This commit is contained in:
Clément OUDOT 2019-07-02 16:36:43 +02:00
parent f370255c3a
commit e04a6f1983
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
View File

@ -19,7 +19,7 @@ use Mouse;
use Lemonldap::NG::Portal::Main::Constants qw(PE_OK PE_REDIRECT);
our $VERSION = '2.0.5';
our $VERSION = '2.0.6';
# OpenID Connect standard claims
use constant PROFILE => [
@ -768,7 +768,9 @@ sub verifyJWTSignature {
. " is present but algorithm is 'none'" );
return 0;
}
return 1;
$self->logger->debug(
"JWT algorithm is 'none', signature cannot be verified");
return 0;
}
if ( $alg eq "HS256" or $alg eq "HS384" or $alg eq "HS512" ) {