Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: use signing jwk to sign oauth state #1728

Merged
merged 2 commits into from
Aug 21, 2024
Merged

fix: use signing jwk to sign oauth state #1728

merged 2 commits into from
Aug 21, 2024

Conversation

kangmingtay
Copy link
Member

What kind of change does this PR introduce?

  • OAuth state is now signed with the same JWK that is used to sign the access tokens

What is the current behavior?

  • currently, it's weird for the GOTRUE_JWT_SECRET to be set (other than it being a fallback option) just for the sake of signing the oauth state

What is the new behavior?

Feel free to include screenshots if it includes visual changes.

Additional context

Add any other context or screenshots.

@kangmingtay kangmingtay requested a review from a team as a code owner August 20, 2024 18:14
@coveralls
Copy link

Pull Request Test Coverage Report for Build 10476966113

Details

  • 23 of 37 (62.16%) changed or added relevant lines in 3 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.006%) to 58.229%
Changes Missing Coverage Covered Lines Changed/Added Lines %
internal/api/external.go 8 12 66.67%
internal/api/jwks.go 14 24 58.33%
Totals Coverage Status
Change from base Build 10470912603: -0.006%
Covered Lines: 9206
Relevant Lines: 15810
💛 - Coveralls

@kangmingtay kangmingtay merged commit 66fd0c8 into master Aug 21, 2024
3 checks passed
@kangmingtay kangmingtay deleted the km/fix-external-state branch August 21, 2024 16:46
@github-actions github-actions bot mentioned this pull request Aug 21, 2024
Merged
kangmingtay pushed a commit that referenced this pull request Aug 21, 2024
@github-actions
chore(master): release 2.159.0 (#1716)
a6de8c9 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([#1731](#1731))
([a9ff361](a9ff361))


### Bug Fixes

* add error codes to password login flow
([#1721](#1721))
([4351226](4351226))
* change phone constraint to per user
([#1713](#1713))
([b9bc769](b9bc769))
* custom SMS does not work with Twilio Verify
([#1733](#1733))
([dc2391d](dc2391d))
* ignore errors if transaction has closed already
([#1726](#1726))
([53c11d1](53c11d1))
* redirect invalid state errors to site url
([#1722](#1722))
([b2b1123](b2b1123))
* remove TOTP field for phone enroll response
([#1717](#1717))
([4b04327](4b04327))
* use signing jwk to sign oauth state
([#1728](#1728))
([66fd0c8](66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@kangmingtay
fix: use signing jwk to sign oauth state (supabase#1728)
5f7ac2a 
## What kind of change does this PR introduce?
* OAuth state is now signed with the same JWK that is used to sign the
access tokens

## What is the current behavior?
* currently, it's weird for the `GOTRUE_JWT_SECRET` to be set (other
than it being a fallback option) just for the sake of signing the oauth
state

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@github-actions
chore(master): release 2.159.0 (supabase#1716)
f8c8ea8 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](supabase/auth@v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([supabase#1731](supabase#1731))
([a9ff361](supabase@a9ff361))


### Bug Fixes

* add error codes to password login flow
([supabase#1721](supabase#1721))
([4351226](supabase@4351226))
* change phone constraint to per user
([supabase#1713](supabase#1713))
([b9bc769](supabase@b9bc769))
* custom SMS does not work with Twilio Verify
([supabase#1733](supabase#1733))
([dc2391d](supabase@dc2391d))
* ignore errors if transaction has closed already
([supabase#1726](supabase#1726))
([53c11d1](supabase@53c11d1))
* redirect invalid state errors to site url
([supabase#1722](supabase#1722))
([b2b1123](supabase@b2b1123))
* remove TOTP field for phone enroll response
([supabase#1717](supabase#1717))
([4b04327](supabase@4b04327))
* use signing jwk to sign oauth state
([supabase#1728](supabase#1728))
([66fd0c8](supabase@66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@kangmingtay @LashaJini
fix: use signing jwk to sign oauth state (supabase#1728)
3cbb260 
## What kind of change does this PR introduce?
* OAuth state is now signed with the same JWK that is used to sign the
access tokens

## What is the current behavior?
* currently, it's weird for the `GOTRUE_JWT_SECRET` to be set (other
than it being a fallback option) just for the sake of signing the oauth
state

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@github-actions @LashaJini
chore(master): release 2.159.0 (supabase#1716)
8f59687 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](supabase/auth@v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([supabase#1731](supabase#1731))
([a9ff361](supabase@a9ff361))


### Bug Fixes

* add error codes to password login flow
([supabase#1721](supabase#1721))
([4351226](supabase@4351226))
* change phone constraint to per user
([supabase#1713](supabase#1713))
([b9bc769](supabase@b9bc769))
* custom SMS does not work with Twilio Verify
([supabase#1733](supabase#1733))
([dc2391d](supabase@dc2391d))
* ignore errors if transaction has closed already
([supabase#1726](supabase#1726))
([53c11d1](supabase@53c11d1))
* redirect invalid state errors to site url
([supabase#1722](supabase#1722))
([b2b1123](supabase@b2b1123))
* remove TOTP field for phone enroll response
([supabase#1717](supabase#1717))
([4b04327](supabase@4b04327))
* use signing jwk to sign oauth state
([supabase#1728](supabase#1728))
([66fd0c8](supabase@66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@kangmingtay @LashaJini
fix: use signing jwk to sign oauth state (supabase#1728)
cd749a9 
## What kind of change does this PR introduce?
* OAuth state is now signed with the same JWK that is used to sign the
access tokens

## What is the current behavior?
* currently, it's weird for the `GOTRUE_JWT_SECRET` to be set (other
than it being a fallback option) just for the sake of signing the oauth
state

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@github-actions @LashaJini
chore(master): release 2.159.0 (supabase#1716)
7f5755e 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](supabase/auth@v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([supabase#1731](supabase#1731))
([a9ff361](supabase@a9ff361))


### Bug Fixes

* add error codes to password login flow
([supabase#1721](supabase#1721))
([4351226](supabase@4351226))
* change phone constraint to per user
([supabase#1713](supabase#1713))
([b9bc769](supabase@b9bc769))
* custom SMS does not work with Twilio Verify
([supabase#1733](supabase#1733))
([dc2391d](supabase@dc2391d))
* ignore errors if transaction has closed already
([supabase#1726](supabase#1726))
([53c11d1](supabase@53c11d1))
* redirect invalid state errors to site url
([supabase#1722](supabase#1722))
([b2b1123](supabase@b2b1123))
* remove TOTP field for phone enroll response
([supabase#1717](supabase#1717))
([4b04327](supabase@4b04327))
* use signing jwk to sign oauth state
([supabase#1728](supabase#1728))
([66fd0c8](supabase@66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hf hf hf approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@kangmingtay @coveralls @hf