search

AnthonyDeroche / mod_authnz_jwt

An authentication module for Apache httpd using JSON Web Tokens
Other
79 stars 46 forks source link

Fix get_decode_key for shared secrets #25

Closed bmerry closed 6 years ago

bmerry commented 6 years ago

The keylen was being set to apr_base64_decode_len, which is only an upper bound on the decoded length, not the exact value. This in turn led to random extra bytes being appended to the key, which in some cases lead to signature verification failures.

Closes #23.