dunglas / mercure / 29640602977

86%

master: 93%

push

github

fix(security): pin the JWT algorithm allowlist in compatibility mode (#1298)

applyModernDefaults returned before assigning the default asymmetric-only
algorithm allowlist whenever a protocol-version compatibility was set. A hub
built with a bare key function (the JWKS path) and no explicit algorithms then
let the parser accept whatever alg the token header declared, so a token forged
as HS256 against an RSA/EC public key could be presented for algorithm
confusion. Apply the allowlist in every mode; a relaxed protocol version must
not relax the signature-algorithm check. Operators pinning a symmetric
algorithm on a bare key function still opt in via WithPublisher/SubscriberJWTAlgorithms.

11 of 13 new or added lines in 1 file covered. (84.62%)

2719 of 3196 relevant lines covered (85.08%)

100.41 hits per line