search

IBM / python-sdk-core

The python-sdk-core repository contains core functionality required by Python code generated by the IBM OpenAPI SDK Generator.
Apache License 2.0
20 stars 27 forks source link

Is this all this method is supposed to do? #140

Closed saintsGrad15 closed 2 years ago

saintsGrad15 commented 2 years ago

I was looking for SDK logic that will validate a bearer token's signature. I found this method and when testing it, it didn't fail when I deliberately changed the signature to nonsense.

When I looked at the code I saw this method doesn't endeavor to do that at all.

Forgive me if I'm missing the intention but is a None-check really all this method is intended to do? If so, may I suggest clarifying that in the docstring?

https://github.com/IBM/python-sdk-core/blob/20cc41f58d8d449fcc679285795dd49b6464be79/ibm_cloud_sdk_core/authenticators/bearer_token_authenticator.py#L45-L56

padamstx commented 2 years ago

Yes, the authenticator doesn't try to validate JWTs on the client side as it treats them as opaque values. We simply make sure there is a value present. We rely on the server to ultimately verify that the access token is valid.