matrix/authentication-service
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-authentication-service.git synced 2025-07-28 11:02:02 +03:00
Code Activity

Add OneOrMany contains claim validator

Browse Source
This commit is contained in:
Kévin Commaille
2022-11-28 11:54:20 +01:00
committed by Quentin Gliech
parent a2a3b3954e
commit f71f68c926
5 changed files with 66 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
crates/oidc-client/src/error.rs
View File

@ -602,10 +602,6 @@ pub enum JwtVerificationError {
#[error(transparent)]
Claim(#[from] ClaimError),
/// The audience of the JWT is not this client.
#[error("wrong aud claim")]
WrongAudience,
/// The algorithm used for signing the JWT is not the one that was
/// requested.
#[error("wrong signature alg")]

5
crates/oidc-client/src/requests/jose.rs
View File

@ -130,10 +130,7 @@ pub fn verify_signed_jwt<'a>(
claims::ISS.extract_required_with_options(&mut claims, issuer.as_str())?;
// Must have the proper audience.
let aud = claims::AUD.extract_required(&mut claims)?;
if !aud.contains(client_id) {
return Err(JwtVerificationError::WrongAudience);
}
claims::AUD.extract_required_with_options(&mut claims, client_id)?;
// Must use the proper algorithm.
if header.alg() != signing_algorithm {