1
85%
master: 93%

Ran 18 Jul 2026 09:50AM UTC

Files 37

Run time 1s

Badge

Embed ▾

Committed 18 Jul 2026 09:45AM UTC coverage: 85.138% (+0.1%) from 85.042%

Job # 29639701340.1

Build Type

Pull #1298

github

Committed by

dunglas

Commit Message

fix(security): pin the JWT algorithm allowlist in compatibility mode

applyModernDefaults returned before assigning the default asymmetric-only
algorithm allowlist whenever a protocol-version compatibility was set. A hub
built with a bare key function (the JWKS path) and no explicit algorithms then
let the parser accept whatever alg the token header declared, so a token forged
as HS256 against an RSA/EC public key could be presented for algorithm
confusion. Apply the allowlist in every mode; a relaxed protocol version must
not relax the signature-algorithm check. Operators pinning a symmetric
algorithm on a bare key function still opt in via WithPublisher/SubscriberJWTAlgorithms.

Pull Request Pull Request #1298: fix(security): pin the JWT algorithm allowlist in compatibility mode

Coverage Stats

2721 of 3196 relevant lines covered (85.14%)

101.42 hits per line

dunglas / mercure / 29639701340 / 1
85%
master: 93%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 0 - 29639701340.1

dunglas / mercure / 29639701340 / 1 85% master: 93%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 0 - 29639701340.1

dunglas / mercure / 29639701340 / 1
85%
master: 93%

README BADGES
x