Skip to content

auth jwt security fixes #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
kernelshard merged 5 commits into from
Aug 11, 2025
Merged

auth jwt security fixes #45

kernelshard merged 5 commits into from
Aug 11, 2025

Conversation

@kernelshard
Copy link
Owner

@kernelshard kernelshard commented Aug 9, 2025

No description provided.

@kernelshard
security: fix JWT algorithm validation and remove debug code
eb06137 
- Add JWT algorithm validation to prevent algorithm confusion attacks
- Fix email claim validation in token validation
- Remove debug fmt.Println() from user storage
- Improve security error logging

Fixes critical JWT security vulnerabilities in auth service
@kernelshard
security: add fix nbf token
8be6217
@kernelshard kernelshard requested a review from mrasif August 9, 2025 17:52
mrasif
mrasif requested changes Aug 9, 2025
View reviewed changes
mrasif
mrasif approved these changes Aug 9, 2025
View reviewed changes
Copy link
Collaborator

@mrasif mrasif left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check that comment only else looks finr

@kernelshard
Copy link
Owner Author

kernelshard commented Aug 10, 2025

@mrasif check please. Test case is failing. Create an issue and assign to yourself or me

@mrasif
Copy link
Collaborator

mrasif commented Aug 11, 2025

@samims, I don't think we need to create issue for test case failure, It should be fixed in the current PR itself. Check the logs of GitHub actions, you will get to know the reason.

Logs: https://github.com/samims/hcaas/actions/runs/16859216987/job/47756846995?pr=45

@kernelshard
Copy link
Owner Author

kernelshard commented Aug 11, 2025

@samims, I don't think we need to create issue for test case failure, It should be fixed in the current PR itself. Check the logs of GitHub actions, you will get to know the reason.

Logs: https://github.com/samims/hcaas/actions/runs/16859216987/job/47756846995?pr=45

well it's not. Please have a look

@mrasif
Copy link
Collaborator

mrasif commented Aug 11, 2025

@samims All test passed!
Problem was you had added password complexity but forgot to update test case accordingly.

@kernelshard kernelshard merged commit d6d3db1 into dev Aug 11, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrasif mrasif mrasif approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kernelshard @mrasif