PPS-2007 PPS-2012 No token audience check #87
Conversation
|
The style in this PR agrees with This formatting comment was generated automatically by a script in uc-cdis/wool. |
Pull Request Test Coverage Report for Build 16530226153Details
💛 - Coveralls |
k-burt-uch
left a comment
There was a problem hiding this comment.
Minor doc and comment clean up. Good to go on my end.
| # was if fence generated it, so this provided no further protection beyond general JWT / public | ||
| # key verification and validation. The validation of which Gen3 instance the token is meant for | ||
| # is already done by using the issuer (`iss` field) to get public keys and verify the signature. | ||
| if aud is not None: |
There was a problem hiding this comment.
We should remove this comment:
https://github.com/uc-cdis/authutils/blob/master/src/authutils/token/core.py#L83
and
https://github.com/uc-cdis/authutils/blob/master/src/authutils/token/core.py#L95 update this
| issuers.append(value) | ||
|
|
||
| # Can't set arg default to config[x] in fn def, so doing it this way. | ||
| if aud is None: |
There was a problem hiding this comment.
This should be updated: https://github.com/uc-cdis/authutils/blob/master/src/authutils/token/validate.py#L85 to avoid confusion on whether the aud is validated or not.
piotrsenkow
left a comment
There was a problem hiding this comment.
The code changes and testing function are very clear and make sense to me, I believe all the comments in the PR have been also addressed. Approving PR, great work.
Link to JIRA ticket if there is one: https://ctds-planx.atlassian.net/browse/PPS-2007 and https://ctds-planx.atlassian.net/browse/PPS-2012
Closes #73 (temporary fix)
New Features
audfield of JWT tokens is not validated anymore. The validation of which Gen3 instance a token is meant for is already done by using the issuerissfield to get public keys and verify the signature.Breaking Changes
audfield of JWT tokens is not validated anymore.Bug Fixes
BASE_URLsetting "https://hostname/user") did not match the "audience" used by the services (typically theUSER_APIsetting "http://fence-service").Improvements
Dependency updates
Deployment changes