fix: wopi context token check #11276
Conversation
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
mklos-kw
force-pushed
the
chore/cs-5
branch
4 times, most recently
from
bf5e3cf to
6737379
Compare
mklos-kw
force-pushed
the
chore/cs-5
branch
2 times, most recently
from
4182c57 to
90998f8
Compare
Ad. non-canonical header, the headers were not changed and are the same as in MS 365 doc: |
| _, _, err = cs3JWTparser.ParseUnverified(wopiContext.AccessToken, cs3Claims) | ||
| _, err = jwt.ParseWithClaims(wopiContext.AccessToken, cs3Claims, func(token *jwt.Token) (interface{}, error) { | ||
|
|
||
| if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok { |
There was a problem hiding this comment.
Taking into account that we're using SigningMethodHS256 everywhere, I'm not sure if we want to be more strict with the check or we're fine with just a comment to specify that we expect HS256 (while allowing other sizes).
There was a problem hiding this comment.
Good point! Updated the code to expect specifically HS256.
There was a problem hiding this comment.
It seems you've forgotten to update this code block 😄
mklos-kw
force-pushed
the
chore/cs-5
branch
2 times, most recently
from
cf6dfaa to
f2b406e
Compare
|
Description
Related Issue
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Checklist: