mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-11-03 07:44:13 +00:00
lukaszraczylo
fd3fbbdbab
The lenient-audience path chose itself when the verify error text contained the word audience. The key lookup error embeds the kid from the unverified token header. A kid of audience made a failed signature look like an audience-only failure. verifyAudience now returns a sentinel and the caller uses errors.Is.
25 lines
831 B
Go
25 lines
831 B
Go
package traefikoidc
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"testing"
|
|
)
|
|
|
|
// Only a real audience mismatch may select the lenient-audience path; an
|
|
// error text that merely embeds the attacker-chosen kid must not.
|
|
func TestAudienceErrorClassifiedBySentinel(t *testing.T) {
|
|
if !errors.Is(fmt.Errorf("standard claim verification failed: %w", verifyAudience("x", "y")), errInvalidAudience) {
|
|
t.Fatal("audience mismatch not recognized through wrapping")
|
|
}
|
|
if errors.Is(verifyAudience("y", "y"), errInvalidAudience) {
|
|
t.Fatal("matching audience classified as mismatch")
|
|
}
|
|
for _, kid := range []string{"audience", "invalid audience"} {
|
|
err := fmt.Errorf("failed to get public key: no matching public key found for kid: %s", kid)
|
|
if errors.Is(err, errInvalidAudience) {
|
|
t.Errorf("kid %q fooled the audience classifier", kid)
|
|
}
|
|
}
|
|
}
|