This is in relation to RFC7523 and the PrivateKeyJWT and ClientSecretJWT classes' sign method. Each class can be initialised with a headers dictionary. In ClientSecretJWT, the self.headers is passed to client_secret_jwt_sign as a kwparam called headers. PrivateKeyJWT doesn't actually pass the headers through to private_key_jwt_sign at all, but should (that's the first problem). This allows people to set things like the kid on the JWT header.
The second problem is that the sign_jwt_bearer_assertion expects a kwarg called header and not headers. At the moment, the headers from ClientSecretJWT.sign() appear to be ignored.
In summary, two issues:
PrivateKeyJWT should pass the self.headers into the private_key_jwt_sign call.
Both ClientSecretJWT and PrivateKeyJWT should pass header=self.headers in the calls to client_secret_jwt_sign and private_key_jwt_sign respectively.
I can create a PR, but I can't see any existing tests for the RFC7353 code in the codebase that I can enhance. Any guidance would be greatly appreciated.
Error Stacks
None
Expected behaviour
I would expect the headers to be passed through and included in the JWT.
Environment:
OS: Ubuntu 22.04 (but not relevant here)
Python Version: 3.10.7 (but not relevant here)
Authlib Version: latest from master (commit cadc55d15e4d15fc1407dc2187fea0208d8b520c)
Additional context
This is being used to implement a flask application that used OIDC Connect with private_key_jwt.
dhallam
commented
1 year ago
Describe the bug
This is in relation to RFC7523 and the
PrivateKeyJWTandClientSecretJWTclasses'signmethod. Each class can be initialised with aheadersdictionary. InClientSecretJWT, theself.headersis passed toclient_secret_jwt_signas a kwparam calledheaders.PrivateKeyJWTdoesn't actually pass the headers through toprivate_key_jwt_signat all, but should (that's the first problem). This allows people to set things like thekidon the JWT header.The second problem is that the
sign_jwt_bearer_assertionexpects a kwarg calledheaderand notheaders. At the moment, theheadersfromClientSecretJWT.sign()appear to be ignored.In summary, two issues:
self.headersinto theprivate_key_jwt_signcall.header=self.headersin the calls toclient_secret_jwt_signandprivate_key_jwt_signrespectively.I can create a PR, but I can't see any existing tests for the RFC7353 code in the codebase that I can enhance. Any guidance would be greatly appreciated.
Error Stacks
None
Expected behaviour
I would expect the headers to be passed through and included in the JWT.
Environment:
Additional context
This is being used to implement a flask application that used OIDC Connect with
private_key_jwt.