Repository navigation
Conversation
## Motivation and Context `JWTVerifier` answered a token whose JOSE header decodes to an array, a number, a boolean or `null` with an error that is not a `JWT::DecodeError`: the jwt gem reads members of the header before it has checked that the header is an object, in the unverified decode `validate_time_claims!` runs or in the verifying decode, depending on the gem version. `verify` rescues only the gem's own errors, so `OAuth::Middleware` and the Streamable HTTP transport answered 500 `server_error` and called the exception reporter where a malformed token gets 401 `invalid_token`. Such a token needs no key. `validate_time_claims!` now refuses a token whose header or payload is not an object as an invalid token, before the verifying decode sees it. ## How Has This Been Tested? `test/mcp/server/oauth/jwt_verifier_test.rb`. Against the previous library the new test fails with `TypeError`. Checked by hand with jwt 2.7.1, 2.8.2, 2.10.1 and 3.3.0: each of the headers in the test is answered as an invalid token. ## Breaking Changes None.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
JWTVerifieranswered a token whose JOSE header decodes to an array, a number, a boolean ornullwith an error that is not aJWT::DecodeError: the jwt gem reads members of the header before it has checked that the header is an object, in the unverified decodevalidate_time_claims!runs or in the verifying decode, depending on the gem version.verifyrescues only the gem's own errors, soOAuth::Middlewareand the Streamable HTTP transport answered 500server_errorand called the exception reporter where a malformed token gets 401invalid_token. Such a token needs no key.validate_time_claims!now refuses a token whose header or payload is not an object as an invalid token, before the verifying decode sees it.How Has This Been Tested?
test/mcp/server/oauth/jwt_verifier_test.rb. Against the previous library the new test fails withTypeError. Checked by hand with jwt 2.7.1, 2.8.2, 2.10.1 and 3.3.0: each of the headers in the test is answered as an invalid token.Breaking Changes
None.
Types of changes
Checklist