You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by "hubodz (via GitHub)" <gi...@apache.org> on 2025/01/29 11:08:56 UTC
[I] Extending JWT claims validation to support other claims [couchdb]
hubodz opened a new issue, #5418:
URL: https://github.com/apache/couchdb/issues/5418
Based on [source](https://github.com/apache/couchdb/blob/main/src/jwtf/src/jwtf.erl), I understand only limited number of JWT claims can be validated. Trying to validate other claims result in error `unknown_checks`.
I would like to ask for introducing validation any provided claim.
In my case, I use an SSO of a huge Organisation, where many users can define their own applications/clients (signed with same SSO key). Without validating `aud`, anyone could create another application with roles that my CouchDB instance accepts.
## Desired Behaviour
When provided a config like below, the claim `aud` should be verified: both if it exists and if it matched provided `my-application` value.
`required_claims = exp, {aud, "my-application"}`
I believe it's worth allowing such a validation for any custom claim (only to check existence and value matching, if provided).
## Possible Solution
I believe the [source](https://github.com/apache/couchdb/blob/main/src/jwtf/src/jwtf.erl) should not limit the check only to claims specified in line 45. There could be a function providing a "general" claim check, no matter what it is exactly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Extending JWT claims validation to support other claims [couchdb]
Posted by "rnewson (via GitHub)" <gi...@apache.org>.
rnewson commented on issue #5418:
URL: https://github.com/apache/couchdb/issues/5418#issuecomment-2648129732
I wouldn't want to add something to couchdb with potential security risks or introduce any deliberate incompatibility with the JWT spec. Allowing bespoke checks might be safe, but not allowing them definitely is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Extending JWT claims validation to support other claims [couchdb]
Posted by "lazedo (via GitHub)" <gi...@apache.org>.
lazedo commented on issue #5418:
URL: https://github.com/apache/couchdb/issues/5418#issuecomment-2924777794
I agree that `aud` is a good addition, just make sure it can be a `string or array of strings` as described in [RFC7519](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3) for both the value that is being checked as well the value that is configured, ie, allow `these` audiences not `this`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Extending JWT claims validation to support other claims [couchdb]
Posted by "hubodz (via GitHub)" <gi...@apache.org>.
hubodz commented on issue #5418:
URL: https://github.com/apache/couchdb/issues/5418#issuecomment-2639720936
Hey, thanks for your answer. Can you tell me more about why the bespoke checks would be a bad idea (as long as it's a simple string comparison)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Extending JWT claims validation to support other claims [couchdb]
Posted by "rnewson (via GitHub)" <gi...@apache.org>.
rnewson commented on issue #5418:
URL: https://github.com/apache/couchdb/issues/5418#issuecomment-2632100923
hm I think a pull request to add `aud` specifically would be fine (and should be fairly easy). Not sure bespoke checks are a good idea.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org