search

tokusumi / fastapi-cloudauth

Simple integration between FastAPI and cloud authentication services (AWS Cognito, Auth0, Firebase Authentication).
MIT License
333 stars 35 forks source link

Disable at_hash verification #58

Closed sindrig closed 2 years ago

sindrig commented 2 years ago

This should resolve #53. We should think about actually verifying the access token itself though.

sindrig commented 2 years ago

@tokusumi any chance of getting this reviewed and published?

sindrig commented 2 years ago

@tokusumi we're currently bundling a locally-built version of fastapi-cloudauth with our application because we need this. We would prefer if we could depend on a released version. LMK if you'd like any improvements/changes.

tokusumi commented 2 years ago

Appreciate @sindrig ! (Sorry for late response)

I confirmed it raise error (due to having at_hash) for AWS cognito ID token acquired from hosted UI, and your proposals resolve them. Thanks 👍