[GitHub] [trafficcontrol] ocket8888 commented on a change in pull request #6641: Use github.com/lestrrat-go/jwx/jwt for JWT

[GitBox <gi...@apache.org>]

ocket8888 commented on a change in pull request #6641:
URL: https://github.com/apache/trafficcontrol/pull/6641#discussion_r827331404



##########
File path: traffic_ops/traffic_ops_golang/api/api.go
##########
@@ -1112,21 +1113,15 @@ func GetUserFromReq(w http.ResponseWriter, r *http.Request, secret string) (auth
 
 func getCookieFromAccessToken(bearerToken string, secret string) (*http.Cookie, error) {
 	var cookie *http.Cookie
-	claims := jwt.MapClaims{}
-	token, err := jwt.ParseWithClaims(bearerToken, claims, func(token *jwt.Token) (interface{}, error) {
-		return []byte(secret), nil
-	})
+	token, err := jwt.Parse([]byte(bearerToken), jwt.WithVerify(jwa.HS256, []byte(secret)))
 	if err != nil {
-		return nil, fmt.Errorf("parsing claims: %w", err)
+		return nil, fmt.Errorf("invalid token: %s", err)

Review comment:
       Error is no longer wrapped  due to formatting parameter change.

##########
File path: traffic_ops/traffic_ops_golang/cdni/shared.go
##########
@@ -496,21 +498,17 @@ func checkBearerToken(bearerToken string, inf *api.APIInfo) (string, error) {
 		return "", errors.New("bearer token is required")
 	}
 
-	claims := jwt.MapClaims{}
-	token, err := jwt.ParseWithClaims(bearerToken, claims, func(token *jwt.Token) (interface{}, error) {
-		return []byte(inf.Config.Secrets[0]), nil
-	})
+	token, err := jwt.Parse([]byte(bearerToken),
+		jwt.WithVerify(jwa.HS256, []byte(inf.Config.Secrets[0])),
+	)
 	if err != nil {
-		return "", fmt.Errorf("parsing claims: %w", err)
-	}
-	if !token.Valid {
 		return "", errors.New("invalid token")

Review comment:
       this now swallows the error encountered by the parser




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org