Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG FIX: Only require nonce in id_token when also passed in body #430

Merged
merged 2 commits into from
Apr 15, 2022
Merged

BUG FIX: Only require nonce in id_token when also passed in body #430

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e52332a
Only require nonce when also passed in
DanMossa Mar 27, 2022
a2d4578
Wrap nonce check in if
DanMossa Mar 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions api/token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import (
"time"

"github.com/coreos/go-oidc/v3/oidc"
jwt "github.com/golang-jwt/jwt"
"github.com/golang-jwt/jwt"
"github.com/netlify/gotrue/conf"
"github.com/netlify/gotrue/metering"
"github.com/netlify/gotrue/models"
Expand Down Expand Up @@ -348,8 +348,8 @@ func (a *API) IdTokenGrant(ctx context.Context, w http.ResponseWriter, r *http.R
return badRequestError("Could not read id token grant params: %v", err)
}

if params.IdToken == "" || params.Nonce == "" {
return oauthError("invalid request", "id_token and nonce required")
if params.IdToken == "" {
return oauthError("invalid request", "id_token required")
}

if params.Provider == "" && (params.ClientID == "" || params.Issuer == "") {
Expand Down Expand Up @@ -379,14 +379,17 @@ func (a *API) IdTokenGrant(ctx context.Context, w http.ResponseWriter, r *http.R
return err
}

// verify nonce to mitigate replay attacks
hashedNonce, ok := claims["nonce"]
if !ok {
return oauthError("invalid request", "missing nonce in id_token")
if (!ok && params.Nonce != "") || (ok && params.Nonce == "") {
return oauthError("invalid request", "Passed nonce and nonce in id_token should either both exist or not.")
}
hash := fmt.Sprintf("%x", sha256.Sum256([]byte(params.Nonce)))
if hash != hashedNonce.(string) {
return oauthError("invalid nonce", "").WithInternalMessage("Possible abuse attempt: %v", r)

if ok && params.Nonce != "" {
// verify nonce to mitigate replay attacks
hash := fmt.Sprintf("%x", sha256.Sum256([]byte(params.Nonce)))
if hash != hashedNonce.(string) {
return oauthError("invalid nonce", "").WithInternalMessage("Possible abuse attempt: %v", r)
}
}

sub, ok := claims["sub"].(string)
Expand Down