Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix JWT key validation #849

Merged
merged 3 commits into from
Jun 12, 2023
Merged

Fix JWT key validation #849

merged 3 commits into from
Jun 12, 2023

Conversation

micahmo
Copy link

@micahmo micahmo commented Jun 9, 2023

Pull request type

Please check the type of change your PR introduces:

  • Bugfix
  • New feature or enhancement
  • UI change (please include screenshot!)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • Documentation content changes
  • Internationalization and localization
  • Other (please describe):

What is the current behavior?

Unless I'm missing something obvious, it's currently impossible to validate tokens with a public key due to two issues:

  • The token algorithm is never set, so the key-building code always tries the wrong algorithm.
  • The public key text box is never displayed, because the visibility is only changed after a successful validation, which can't happen without the public key (chicken-and-egg).

(The unit tests have worked because they set the algorithm and public key explicitly.)

I also fixed a small issue related to encoding where the error banner would show when there wasn't an error and hide when there was!

What is the new behavior?

Before: Don't even see the option for a public key. Obviously pasting it in the signature field doesn't work.

DevToys-JWT-Validation-Before.mp4

After: Pasting a JWT with an RSA-encoded signature shows the Public key field and successfully validates.

DevToys-JWT-Validation-After.mp4

Other information

Quality check

Before creating this PR:

  • Did you follow the code style guideline as described in CONTRIBUTING.md
  • Did you build the app and test your changes?
  • Did you check for accessibility? On Windows, you can use Accessibility Insights for this.
  • Did you verify that the change work in Release build configuration
  • Did you verify that all unit tests pass
  • If necessary and if possible, did you verify your changes on:
    • Windows
    • macOS (DevToys 2.0)
    • Linux (DevToys 2.0)

Copy link
Collaborator

@btiteux btiteux left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, thank you for this fix, I totally forgot the public key validation.

@veler
Copy link
Collaborator

veler commented Jun 11, 2023

I see you updated the unit tests, but I don't seem to find any added unit tests that covers this scenario. Can we please add some?

@micahmo
Copy link
Author

micahmo commented Jun 12, 2023

I see you updated the unit tests, but I don't seem to find any added unit tests that covers this scenario. Can we please add some?

Yes, I only updated the tests as needed to match the new signature of DecodeToken. But I agree, I should validate that the method properly detects and assigns the algorithm rather than specifying it in the test input. Done in 0294333.

Copy link
Collaborator

@veler veler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much for this! I approved the PR. It will be shipped as part of the next update (no ETA)

@veler veler merged commit f847874 into DevToys-app:main Jun 12, 2023
@micahmo micahmo deleted the fix/jwt-validation branch June 12, 2023 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants