You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by GitBox <gi...@apache.org> on 2021/10/31 08:40:32 UTC
[GitHub] [couchdb] cborgolte opened a new issue #3811: JWT: exp claim is not validated
cborgolte opened a new issue #3811:
URL: https://github.com/apache/couchdb/issues/3811
When not configured as required claim, the **exp** claim is not validated.
## Description
It is stated in the documentation that "All claims presented in a JWT token are validated if presented, regardless of whether they are required."
While playing around with JWT configurations in CouchDB I observed, that this is not the truth for the exp claim
## Steps to Reproduce
```
NAME=couchn
PORT=25984
docker pull couchdb
docker run -d -e COUCHDB_USER=admin -e COUCHDB_PASSWORD=1234 --name $NAME -p $PORT:5984 couchdb
add-cors-to-couchdb http://localhost:$PORT -u admin -p 1234
# setup jwt auth
curl -s -u admin:1234 localhost:$PORT/_node/_local/_config/chttpd/authentication_handlers -XPUT -d '"{chttpd_auth, jwt_authentication_handler}, {chttpd_auth, cookie_authentication_handler}, {chttpd_auth, default_authentication_handler}"'| jq
docker restart $NAME # seems necessary
# set default secret
curl -s -u admin:1234 localhost:$PORT/_node/_local/_config/jwt_keys/hmac:_default -XPUT -d '"anVwcGll"'| jq
# set additional secret named 'new'
curl -s -u admin:1234 localhost:$PORT/_node/_local/_config/jwt_keys/hmac:new -XPUT -d '"cGFzc3dvcmQ="'| jq
# call couchdb with expired token (see https://jwt.io/#debugger-io?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Im5ldyJ9.eyJzdWIiOiJjYm8iLCJuYW1lIjoiSm9obiBEb2UiLCJleHAiOjE1MzU0NTMxODksIl9jb3VjaGRiLnJvbGVzIjpbIl91c2VyIl19.Y7_oMX6wpKy6xAz8a-KYlNiy3weKmH70z2cThZ7hFmI)
curl -i -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Im5ldyJ9.eyJzdWIiOiJjYm8iLCJuYW1lIjoiSm9obiBEb2UiLCJleHAiOjE1MzU0NTMxODksIl9jb3VjaGRiLnJvbGVzIjpbIl91c2VyIl19.Y7_oMX6wpKy6xAz8a-KYlNiy3weKmH70z2cThZ7hFmI" localhost:$PORT/_session
# Result:
#
# HTTP/1.1 200 OK
# Cache-Control: must-revalidate
# Content-Length: 139
# Content-Type: application/json
# Date: Sun, 31 Oct 2021 08:20:35 GMT
# Server: CouchDB/3.2.0 (Erlang OTP/20)
#
# {"ok":true,"userCtx":{"name":"cbo","roles":["_user"]},"info":{"authentication_handlers":["jwt","cookie","default"],"authenticated":"jwt"}}
# set required claims
curl -s -u admin:1234 localhost:$PORT/_node/_local/_config/jwt_auth/required_claims -XPUT -d '"exp"'| jq
# now again, call couchdb with same expired token
curl -i -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Im5ldyJ9.eyJzdWIiOiJjYm8iLCJuYW1lIjoiSm9obiBEb2UiLCJleHAiOjE1MzU0NTMxODksIl9jb3VjaGRiLnJvbGVzIjpbIl91c2VyIl19.Y7_oMX6wpKy6xAz8a-KYlNiy3weKmH70z2cThZ7hFmI" localhost:$PORT/_session
# Result:
#
# HTTP/1.1 401 Unauthorized
# Cache-Control: must-revalidate
# Content-Length: 54
# Content-Type: application/json
# Date: Sun, 31 Oct 2021 08:24:51 GMT
# Server: CouchDB/3.2.0 (Erlang OTP/20)
# X-Couch-Request-ID: e8bf079ec6
# X-CouchDB-Body-Time: 0
#
# {"error":"unauthorized","reason":"exp not in future"}
```
## Expected Behaviour
The first call should have returned with status code 401
## Your Environment
Mac OX running docker desktop
```
docker images
couchdb latest 5c2fff885de6 2 weeks ago 185MB
```
```
curl -i localhost:25984
HTTP/1.1 200 OK
Cache-Control: must-revalidate
Content-Length: 247
Content-Type: application/json
Date: Sun, 31 Oct 2021 08:35:42 GMT
Server: CouchDB/3.2.0 (Erlang OTP/20)
X-Couch-Request-ID: ce4dee17c7
X-CouchDB-Body-Time: 0
{"couchdb":"Welcome","version":"3.2.0","git_sha":"efb409bba","uuid":"3013e89760d5238512e5dd2fc3f307bb","features":["access-ready","partitioned","pluggable-storage-engines","reshard","scheduler"],"vendor":{"name":"The Apache Software Foundation"}}
````
## Additional Context
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb] janl closed issue #3811: JWT: exp claim is not validated
Posted by GitBox <gi...@apache.org>.
janl closed issue #3811:
URL: https://github.com/apache/couchdb/issues/3811
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [couchdb] rnewson commented on issue #3811: JWT: exp claim is not validated
Posted by GitBox <gi...@apache.org>.
rnewson commented on issue #3811:
URL: https://github.com/apache/couchdb/issues/3811#issuecomment-956311317
Ah, sorry, this changed on purpose in https://github.com/apache/couchdb/commit/331894a6acb4565c71d800f2e63206101dfbb48c after consulting the RFC 7519 specification.
The docs need updating.
cc @jaydoane
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org