search

googleworkspace / apps-script-oauth2

An OAuth2 library for Google Apps Script.
https://developers.google.com/apps-script/
Apache License 2.0
1.56k stars 429 forks source link

JWT token that doesn't supply expiration is assumed as valid #335

Open jonathanwiesel opened 3 years ago

jonathanwiesel commented 3 years ago

When a token response does not supply the current detected attributes for token expiration (expires_in_sec, expires_in, expires) the token is assumed to be valid.

sqrrrl commented 2 years ago

Need more information for this to be actionable. Can you provide a sample of where you think this is an issue?

AFAICT non-expiring JWTs are allowed (although strongly discouraged) and it's not clear what, if any, changes should be made to the library.

jonathanwiesel commented 2 years ago

Sure thing, the hasAccessmethod is checking the isExpired method, which checks for specific attributes (expires_in_sec, expires_in, expires) to determine expiration, in case there's no expiration supplied (rare but could happen) or the expiration attribute name is different than the currently configured ones (for example exp) the method returns false, therefore considering it not expired.

Would be great that in case a different expiration attribute is supplied by a system it could be at least supplied as configuration