Closed max-lt closed 6 years ago
Thanks @maxx-t . This crept into the code when I started setting headers for these fields so I can log them. I've commited a code change to include the two test JWT's in this issue and some code to only set the headers when the values are present in the JWT.
For posterity: see #29
Missing sub or emailAddress leads to segmentation fault
When checking a token that have no "emailAddress" or/and "sub" field, nginx worker process get killed for segfault.
without emailAddress:
without sub:
Workaround:
Adding
goto redirect;
at the end of the two blocks that make these verifications does the trick BUT as we face a JWT that have been correctly signed but does not meets requirements I suggest not to redirect to the authentication server (if redirect set) to avoid redirection loop nor returning with a 401 status (because it could be handled with the nginx'serror_page
directive (likeerror_page 401 = /go_to_login;
) and lead to a redirection loop too. Adding aelse
block with the custom headers affectation works as well.. but headers will be unset.For now, i'm returning a 403 (NGX_HTTP_FORBIDDEN) code because a 403 response should prevent the request to be repeated (https://tools.ietf.org/html/rfc2616#section-10.4.2).
How to reproduce:
In your nginx.conf file: change your error_log to
error_log /dev/stderr info;
(you wont see anything otherwise).Run tests with: