apache / pulsar-manager

Apache Pulsar Manager
https://pulsar.apache.org/
Apache License 2.0
516 stars 245 forks source link

Remove JWT validation from production code #547

Closed JLLeitschuh closed 8 months ago

JLLeitschuh commented 8 months ago

Motivation

CodeQL was flagging the current use of JWT as being vulnerable as validateBrokerToken wasn't actually performing validlidation of the signature.

Since the logic is unused, except for in test, the entire chunk of logic has been moved exclusively to tests.

Explain here the context, and why you're making that change. What is the problem you're trying to solve.

Modifications

Move JwtServiceImpl#validateBrokerToken logic into BrokerTokensServiceImplTest

Verifying this change