auth: handle KeyProvider in Verify to fix go-jose unsupported key type error#1461
Open
ctonneslan wants to merge 1 commit intolivekit:mainfrom
Open
auth: handle KeyProvider in Verify to fix go-jose unsupported key type error#1461ctonneslan wants to merge 1 commit intolivekit:mainfrom
ctonneslan wants to merge 1 commit intolivekit:mainfrom
Conversation
…e error
Verify() accepts interface{} but only handled string and []byte. When
users pass a SimpleKeyProvider (which implements KeyProvider), go-jose
rejects it with 'unsupported key type/format' because it doesn't know
how to use a struct as an HMAC key.
Now Verify checks for the KeyProvider interface first, resolves it to
the secret string for the token's API key, and converts to []byte
before passing to go-jose.
Fixes livekit/server-sdk-go#647
|
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes livekit/server-sdk-go#647
Problem
Verify(key interface{})only handlesstringand[]byteinputs. When a user passes a*SimpleKeyProvider(which implements theKeyProviderinterface), the provider struct gets passed straight through to go-jose, which rejects it withgo-jose: unsupported key type/format.This is a pretty natural mistake to make since
Verifytakesinterface{}andSimpleKeyProvideris the obvious thing to pair withParseAPIToken. The existing tests all pass the secret string directly, so this path was never covered.Fix
Added a type check for
KeyProviderat the top ofVerify. If the caller passes a provider, we resolve it to the secret string for the token's API key before converting to[]byte. If the provider returns an empty secret (wrong key), we returnErrKeysMissing.Tests
Two new test cases:
verify with KeyProvider: creates a token, verifies it withNewSimpleKeyProvider, checks claimsverify with KeyProvider wrong key returns error: verifies that a provider with the wrong key failsAll existing tests still pass.