Check JWT Date fields and issuer and audience field

yokomizor / ejabberd-auth-jwt

:speech_balloon: Ejabberd authentication module using JWT tokens

Apache License 2.0

5 stars 2 forks source link

Check JWT Date fields and issuer and audience field #9

Open ThomasChiroux opened 5 years ago

ThomasChiroux commented 5 years ago

It sems that current version does not check JWT against exp, iat, nbf fields. So currently a given JWT does give infinite access for the user. It seems important to support this features for security reasons.

In addition,checking agains issuer and audience (if found in config) could be nice too.

yokomizor commented 5 years ago

Hey @ThomasChiroux, Thank you for your feedback.

JWT exp, iat and nbf should be verified by jose_jwt. I believe that verify is rejecting expired tokens.

About checking issuer and audience, indeed, it would be very nice 👍

Would you be interested in implementing it?