Merge pull request #354 from lestrrat-go/topic/fix-validation

Fix JWT validation

Author: lestrrat

Changes

@@ -1,6 +1,17 @@
 Changes
 =======
 
+v1.1.5 12 Mar 2021
+  This is a security fix release. The JWT validation could be skipped
+  for empty values. Upgrade recommended
+
+[Security Fix]
+  * JWT validation could be skipped for empty fields (#352).
+
+[Bug fixes]
+  * Allow setting JWT "typ" fields to any value (#351).
+  * Remove stray replace directive in cmd/jwx/go.mod (#349)
+
 v1.1.4 02 Mar 2021
 [New features]
   * jwt.ParseRequest, jwt.ParseHeader, jwt.ParseForm have been added.

jwt/jwt_test.go

@@ -270,6 +270,19 @@ func TestJWTParseVerify(t *testing.T) {
 func TestValidateClaims(t *testing.T) {
 	t.Parallel()
 	// GitHub issue #37: tokens are invalid in the second they are created (because Now() is not after IssuedAt())
+	t.Run("Empty fields", func(t *testing.T) {
+		token := jwt.New()
+
+		if !assert.Error(t, jwt.Validate(token, jwt.WithIssuer("foo")), `token.Validate shold fail`) {
+			return
+		}
+		if !assert.Error(t, jwt.Validate(token, jwt.WithJwtID("foo")), `token.Validate shold fail`) {
+			return
+		}
+		if !assert.Error(t, jwt.Validate(token, jwt.WithSubject("foo")), `token.Validate shold fail`) {
+			return
+		}
+	})
 	t.Run(jwt.IssuedAtKey+"+skew", func(t *testing.T) {
 		t.Parallel()
 		token := jwt.New()

jwt/validate.go

@@ -49,21 +49,21 @@ func Validate(t Token, options ...ValidateOption) error {
 
 	// check for iss
 	if len(issuer) > 0 {
-		if v := t.Issuer(); v != "" && v != issuer {
+		if v := t.Issuer(); v != issuer {
 			return errors.New(`iss not satisfied`)
 		}
 	}
 
 	// check for jti
 	if len(jwtid) > 0 {
-		if v := t.JwtID(); v != "" && v != jwtid {
+		if v := t.JwtID(); v != jwtid {
 			return errors.New(`jti not satisfied`)
 		}
 	}
 
 	// check for sub
 	if len(subject) > 0 {
-		if v := t.Subject(); v != "" && v != subject {
+		if v := t.Subject(); v != subject {
 			return errors.New(`sub not satisfied`)
 		}
 	}