search

pow-auth / assent

Multi-provider framework in Elixir
https://powauth.com
MIT License
406 stars 47 forks source link

Boolean field may contain an error-tuple which can cause issues #129

Closed janpieper closed 1 year ago

janpieper commented 1 year ago

The map returned by Assent.JWTAdapter.AssentJWT.verify/3 may have the verified?-key set to an {:error, _} tuple, which may cause issues when doing a simple check for trueness.

token = "..."
secret = %{...}

{:ok, details} = Assent.JWTAdapter.AssentJWT.verify(token, secret, [json_adapter: Jason])

if details.verified? do
  IO.puts("Everything is cool!")
else
  IO.puts("Verification failed.")
end

You may see Everthing is cool! although an error occurred, because verified? contains an {:error, _} tuple. Here's an example of where the tuple can come from:

https://github.com/pow-auth/assent/blob/d2c4675473204cbb6bba5ec3e49f225342c011d4/lib/assent/jwt_adapter/assent_jwt.ex#L171

Sadly, I cannot provide you with the token and secret I stumpled upon that error, but by looking at the code, you already see that the error-tuple is a possible value for the verified?-field.

danschultzer commented 1 year ago

Thanks @janpieper , this has been resolved with https://github.com/pow-auth/assent/pull/130

The error handling was all over the place due to no tests. I'll push a release very soon.