Bug Report
- import path of package in question:
github.com/Azure/azure-sdk-for-go/sdk/messaging/azwebpubsub
- SDK version:
0.1.1
- output of
go version: go version go1.26.6 darwin/arm64
The SDK incorrectly sets the audience of the JWT to a host using the same scheme as the HTTP API (i.e. http or https). This yields JWTs that are rejected by the server. The expected scheme for the audience field is wss. This has essentially made the SDK unusable for generating client access URLs since its conception.
|
audience := fmt.Sprintf("%sclient/hubs/%s", parsedURL.String(), hubPath) |
|
|
|
parsedURL.Scheme = strings.Replace(strings.ToLower(parsedURL.Scheme), "http", "ws", 1) |
|
baseURL := fmt.Sprintf("%sclient/hubs/%s", parsedURL.String(), hubPath) |
|
|
|
var token string |
|
if c.key != nil { |
|
token, err = c.signJwtToken(audience, options) |
- What did you expect or want to happen?
The SDK should generate tokens and URLs that work with a WebSocket client without the server returning 401 Forbidden. The clients using a token or URL should be able to connect successfully.
Just test using GenerateClientAccessURL. It will return a JWT with an aud set to https://... when it should be wss. This can be confirmed by connecting to a server, which will reject the request.
- Anything we should know about your environment.
Web PubSub Service SKU Premium P1, version 1.0.
Bug Report
github.com/Azure/azure-sdk-for-go/sdk/messaging/azwebpubsub0.1.1go version:go version go1.26.6 darwin/arm64The SDK incorrectly sets the audience of the JWT to a host using the same scheme as the HTTP API (i.e.
httporhttps). This yields JWTs that are rejected by the server. The expected scheme for the audience field iswss. This has essentially made the SDK unusable for generating client access URLs since its conception.azure-sdk-for-go/sdk/messaging/azwebpubsub/client_custom.go
Lines 122 to 129 in 48df4ea
The SDK should generate tokens and URLs that work with a WebSocket client without the server returning 401 Forbidden. The clients using a token or URL should be able to connect successfully.
Just test using
GenerateClientAccessURL. It will return a JWT with anaudset tohttps://...when it should bewss. This can be confirmed by connecting to a server, which will reject the request.Web PubSub Service SKU Premium P1, version 1.0.