search

omniauth / omniauth_openid_connect

MIT License
170 stars 187 forks source link

Fall back to the discovered jwks when no key specified #97

Closed andrewshadura closed 3 years ago

andrewshadura commented 3 years ago

When no key has been explicitly specified, key_or_secret may return an empty value, leading to a token decoding error, when discovery is disabled:

JSON::JWS::VerificationFailed (JSON::JWS::VerificationFailed):
  /usr/lib/ruby/vendor_ruby/json/jws.rb:26:in `verify!'
  /usr/lib/ruby/vendor_ruby/json/jws.rb:149:in `decode_compact_serialized'
  /usr/lib/ruby/vendor_ruby/json/jwt.rb:86:in `decode_compact_serialized'
  /usr/lib/ruby/vendor_ruby/json/jose.rb:52:in `decode'
  ...

The actual discovery is performed in any case (but the discovered values aren’t used), so why not use that key if nothing else is available.