lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(apiserver): pin JWT parsing to the HS256 signing algorithm (bug-1950)

Browse source 
Cause: the ValidateHandler parse callback (middleware isValidToken)
returned the secret without looking at token.Method, and
GetUsernameFromToken accepted any HMAC variant, so tokens signed with
HS384/HS512 were accepted although the server only signs HS256.

Fix: one JWTSigningMethod (HS256) used for signing, plus a shared
JWTKeyFunc (rejects any other alg) and JWTValidMethods parser option used
by both parse paths.

Tests: TestIsValidToken_PinsSigningAlgorithm (middleware),
TestGetUsernameFromToken_PinsSigningAlgorithm (controllers).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 08:29:37 +00:00
parent f91642dbc0
commit 42dd1e7a5e
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
4 changed files with 139 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/frontend/apiserver/middleware/validatehandler.go
View file

@ -4,7 +4,6 @@ import (
"apiserver/common"
"apiserver/controllers"
"apiserver/models"
"apiserver/utils"
logger "apiserver/utils"
"bytes"
"encoding/json"
@ -99,9 +98,8 @@ func validateHeader() gin.HandlerFunc {
}
func isValidToken(tokenString string, IP string) (bool, error) {
token, err := jwt.ParseWithClaims(tokenString, &models.JWTClaims{}, func(token *jwt.Token) (interface{}, error) {
return []byte(utils.AuthenticationYamlConfig.Token.SecretKey), nil
})
token, err := jwt.ParseWithClaims(tokenString, &models.JWTClaims{},
controllers.JWTKeyFunc, controllers.JWTValidMethods())
if err != nil {
return false, err