search

qor / auth

Golang Authentication solution
MIT License
733 stars 99 forks source link

Upgrade dgrijalva/jwt-go v3.2.0 to golang-jwt/jwt v4.3.0 #47

Open Clasyc opened 2 years ago

Clasyc commented 2 years ago

dgrijalva/jwt-go v3.2.0 has a security issue CVE-2020-26160, a security patch does not exist and it is recommended to switch to golang-jwt.

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

https://github.com/golang-jwt/jwt/blob/main/MIGRATION_GUIDE.md

Clasyc commented 2 years ago

@raven-chen please, can you take a look on this?

theplant-ci commented 10 months ago

PR needs rebase.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.