dgrijalva / jwt-go

ARCHIVE - Golang implementation of JSON Web Tokens (JWT). This project is now maintained at:
https://github.com/golang-jwt/jwt
MIT License
10.78k stars 997 forks source link

Fix security vulnerability #476

Closed giorgos-f3 closed 3 years ago

giorgos-f3 commented 3 years ago

THE ISSUE

Right now, if you were to validate the expires_at, not_before, and issued_at jwt fields while not setting them up as required.. Even if the presented value was an invalid string, the verification would pass.

Solution

Make sure that if the type is not expected, we return false. The presented solution should not cause any breaking changes.

Also, proceeded to add modules.