Closed gdkita closed 1 year ago
It should now be reading "Permissions" from this commit. This change is now available from v6.9.1+ that's now available on MyGet.
Can you also please get Björn to update the Licenses registered support contact as you're currently not an authorized user, thanks.
Describe the issue
After upgrading from ServiceStack 6.0.2 to 6.9.0 our JWT verification stopped working.
Our code uses
JwtAuthProviderReader
to validate a token generated by another service and the solution we are using works up until version 6.4.0. Once we upgrade to version 6.5.0 we can no longer generateAuthUserSession
by usingJwtAuthProviderReader
.We have done some debugging and discovered that in version 6.5.0 and up the code responsible for parsing the Permissions claim (same is valid for the Roles claim too) have changed from:
to
The code is located in class
ServiceStack.Auth.UserAuth
line 493 in vesion 6.5.0 (the code is quite similar in 6.9.0 as well).Which causes an error if the claim
perms
is not present in the token. We have onlyPermissions
claim in our token which results in the methodGetUnescaped
to throw aKeyNotFound
exception when it tries to extract data fromperms
.Additionally if the
perms
claim is not present in the JWTjsonObj.GetUnescaped
will not attempt to extract data from thePerms
claim, but will silently fail, unless you are running the code withSource Link
debugging. (Same is valid for theRules
claim).The end result is that even if the JWT is correct, the claim parsing error will prevent a user session from being established. As a side effect if the permissions and roles are stored in any other claim than the explicit
perms
androles
they will not be populated.Reproduction
Create a valid JWT conaining a claim
Permissions
and withoud adding a claimperms
in it. Setup theAuthFeature
plugin:Once you attempt to access a REST endpoint and verify the user session, that session will not be filled with the correct information from the token and under debug mode you will see
KeyNotFound
error triggered by the extension methodGetUnescaped
.Expected behavior
After the JWT is validated and the claims parsed a correct
AuthUserSession
should be established containing the correct permissions and roles stored in thePermissions
andRoles
claims respectively.System Info
Additional context
For information related to the ServiceStack licence please contact bjoern.hultqvist@gogift.com
Validations