search

Keats / jsonwebtoken

JWT lib in rust
MIT License
1.64k stars 260 forks source link

can't handle null values if they are present #293

Open spencerbart opened 1 year ago

spencerbart commented 1 year ago

Screenshot 2023-02-18 at 22 02 06

Json deserializing breaks when "aud" is null like in this case.

Here's the error message

Error(Json(Error("duplicate field `aud`", line: 1, column: 257)))

There is no other aud field.

Keats commented 1 year ago

I'm not sure why this error happens but that would be an invalid JWT either way. We should have a better error though but it looks like it comes from serde somehow

spencerbart commented 1 year ago

https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3

@Keats you are correct. It would be an invalid JWT. I didn’t realize that at first.

Our Ruby On Rails monolith issues these JWTs with a Devise plugin. We’re building a Rust microservice and I couldn’t get authentication to work. I realize now that it’s an issue with our Rails service. I just couldn’t figure out the issue because Rails and jwt.io would be able to validate it and Rust couldn’t.