Verify the claims from JWT submitted by clients in auth

matrix-org / matrix-authentication-service

OAuth2.0 + OpenID Provider for Matrix Homeservers

Apache License 2.0

109 stars 32 forks source link

Open sandhose opened 1 year ago

sandhose commented 1 year ago

It seems like we're not validating anything form the JWTs sent for client auth. What should be checked is defined in RFC7523: https://www.rfc-editor.org/rfc/rfc7523#section-3

matrixbot commented 1 week ago

For your information, this issue has been copied over to the Element fork of matrix-authentication-service: https://github.com/element-hq/matrix-authentication-service/issues/907