dunglas / mercure / 29639701340

85%

master: 93%

Pull #1298

github

fix(security): pin the JWT algorithm allowlist in compatibility mode

applyModernDefaults returned before assigning the default asymmetric-only
algorithm allowlist whenever a protocol-version compatibility was set. A hub
built with a bare key function (the JWKS path) and no explicit algorithms then
let the parser accept whatever alg the token header declared, so a token forged
as HS256 against an RSA/EC public key could be presented for algorithm
confusion. Apply the allowlist in every mode; a relaxed protocol version must
not relax the signature-algorithm check. Operators pinning a symmetric
algorithm on a bare key function still opt in via WithPublisher/SubscriberJWTAlgorithms.

11 of 13 new or added lines in 1 file covered. (84.62%)

2721 of 3196 relevant lines covered (85.14%)

101.42 hits per line