You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "hanicz (via GitHub)" <gi...@apache.org> on 2026/04/09 12:47:31 UTC
[PR] KNOX-3295: Set default type to JWT in issued knox token headers [knox]
hanicz opened a new pull request, #1195:
URL: https://github.com/apache/knox/pull/1195
[KNOX-3295](https://issues.apache.org/jira/browse/KNOX-3295) - Set default type to JWT on issued tokens
## What changes were proposed in this pull request?
Sets the default type in JWT headers to `JWT`
## How was this patch tested?
Tested locally with the sandbox topology
```
<service>
<role>KNOXTOKEN</role>
<param>
<name>knox.token.ttl</name>
<value>36000000</value>
</param>
<param>
<name>knox.token.audiences</name>
<value>tokenbased</value>
</param>
<param>
<name>knox.token.target.url</name>
<value>https://localhost:8443/gateway/tokenbased</value>
</param>
<param>
<name>knox.token.exp.server-managed</name>
<value>true</value>
</param>
</service>
```
`curl -ivku admin:admin-password https://localhost:8443/gateway/sandbox/knoxtoken/api/v1/token`
```
{
"jku": "https://localhost:8443/gateway/sandbox/knoxtoken/api/v1/jwks.json",
"kid": "_AGCGyQJ0pIceEVPCmVMkTTC4DddcGG_5XQAhgImjyw",
"typ": "JWT",
"alg": "RS256"
}
```
## Integration Tests
N/A
## UI changes
N/A
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3295: Set default type to JWT in issued knox token headers [knox]
Posted by "hanicz (via GitHub)" <gi...@apache.org>.
hanicz merged PR #1195:
URL: https://github.com/apache/knox/pull/1195
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3295: Set default type to JWT in issued knox token headers [knox]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1195:
URL: https://github.com/apache/knox/pull/1195#issuecomment-4214816539
## Test Results
7 tests 7 ✅ 1s ⏱️
1 suites 0 💤
1 files 0 ❌
Results for commit 8f8be648.
[test-results]:data:application/gzip;base64,H4sIAGCw12kC/1WMSQ7DIBAEv2JxzsFA5IF8JsIs0sgLEcvJyt+DHS/41lUt1UIcjjaSV0MfDYkZ0wkmB5XQzzuWI60XHPsds9Z3MeCniPYUTuF4EzYEH3YT8nz01lnn/nzVNq5iG9ct7acJUwEinOht9xQAXHS0BdZzxQ23CoyWjEomnREaOPn+AL9PkX37AAAA
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3295: Set default type to JWT in issued knox token headers [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 commented on code in PR #1195:
URL: https://github.com/apache/knox/pull/1195#discussion_r3058020690
##########
gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java:
##########
@@ -514,6 +514,57 @@ public void testSignatureAlgorithm() throws Exception {
assertTrue(parsedToken.getHeader().contains("RS512"));
}
+ @Test
+ public void testDefaultTokenType() throws Exception {
+ final Map<String, String> contextExpectations = new HashMap<>();
+ configureCommonExpectations(contextExpectations);
+
+ TokenResource tr = new TokenResource();
+ tr.request = request;
+ tr.context = context;
+ tr.init();
+
+ // Issue a token
+ Response retResponse = tr.doGet();
+
+ assertEquals(200, retResponse.getStatus());
+
+ // Parse the response
+ String retString = retResponse.getEntity().toString();
+ String accessToken = getTagValue(retString, "access_token");
+ assertNotNull(accessToken);
+
+ // Verify the token
+ JWT parsedToken = new JWTToken(accessToken);
+ assertTrue(parsedToken.getHeader().contains("\"typ\":\"JWT\""));
+ }
+
+ @Test
+ public void testCustomTokenType() throws Exception {
+ final Map<String, String> contextExpectations = new HashMap<>();
+ contextExpectations.put("knox.token.type", "custom-type");
Review Comment:
I'd make `org.apache.knox.gateway.service.knoxtoken.TokenResource#TOKEN_TYPE_PARAM` public and use it here.
##########
gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java:
##########
@@ -514,6 +514,57 @@ public void testSignatureAlgorithm() throws Exception {
assertTrue(parsedToken.getHeader().contains("RS512"));
}
+ @Test
+ public void testDefaultTokenType() throws Exception {
Review Comment:
I don't think this is needed. A simple verification in the `testGetToken` method would be enough:
```
...
assertEquals("alice", parsedToken.getSubject());
assertTrue(parsedToken.getHeader().contains("\"typ\":\"JWT\""));
...
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org