Skip to content

fix: fix IdTokenVerifier so it does not cache empty entries #892

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 23 commits into from
Jun 2, 2022
Merged
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
acb985f
verifier signature fix port
TimurSadykov Mar 23, 2022
1c16f8f
more test cases
TimurSadykov Mar 24, 2022
872f5f6
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Mar 25, 2022
70ac584
fix: more test fixes
TimurSadykov Mar 28, 2022
5dde913
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Mar 28, 2022
5c83d47
Update google-oauth-client/src/main/java/com/google/api/client/auth/o…
TimurSadykov Mar 30, 2022
17affb3
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Mar 30, 2022
4d34201
fix: restored original interface for verifier, added default http fac…
TimurSadykov Mar 31, 2022
9611f53
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Mar 31, 2022
8b55b29
Update google-oauth-client/src/main/java/com/google/api/client/auth/o…
TimurSadykov Mar 31, 2022
813bb20
Update google-oauth-client/src/main/java/com/google/api/client/auth/o…
TimurSadykov Mar 31, 2022
e065d1a
doc fixes
TimurSadykov Mar 31, 2022
1af2370
fix: better docs and logging of validation exceptions
TimurSadykov Apr 3, 2022
22178ca
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Apr 3, 2022
c8d01d3
Update google-oauth-client/src/main/java/com/google/api/client/auth/o…
TimurSadykov Apr 12, 2022
aca11aa
nit and linter fixes
TimurSadykov Apr 12, 2022
1d668f8
Merge remote-tracking branch 'origin/main' into stim-signer
TimurSadykov May 31, 2022
6cd7d8c
fix: add verify without signature verification, remove caching empty …
TimurSadykov May 31, 2022
964c5a8
fix: docs for a new method
TimurSadykov May 31, 2022
d51d221
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] May 31, 2022
8f9f8f1
fix: docs for a new method
TimurSadykov Jun 1, 2022
ff2474e
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jun 1, 2022
50eb0cc
fix: more test cases
TimurSadykov Jun 2, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: docs for a new method
  • Loading branch information
TimurSadykov committed May 31, 2022
commit 964c5a85989a1ca1711291a1045c48d34602c7f0
Original file line number Diff line number Diff line change
Expand Up @@ -252,14 +252,34 @@ public boolean verify(IdToken idToken) {
return false;
}
}


/**
* Verifies the payload of the given ID token
*
* <p>It verifies:
*
* <ul>
* <li>The issuer is one of {@link #getIssuers()} by calling {@link
* IdToken#verifyIssuer(String)}.
* <li>The audience is one of {@link #getAudience()} by calling {@link
* IdToken#verifyAudience(Collection)}.
* <li>The current time against the issued at and expiration time, using the {@link #getClock()}
* and allowing for a time skew specified in {@link #getAcceptableTimeSkewSeconds()} , by
* calling {@link IdToken#verifyTime(long, long)}.
* </ul>
*
* <p>Overriding is allowed, but it must call the super implementation.
*
* @param idToken ID token
* @return {@code true} if verified successfully or {@code false} if failed
*/
protected boolean verifyPayload(IdToken idToken) {
boolean tokenFieldsValid =
boolean tokenPayload =
(issuers == null || idToken.verifyIssuer(issuers))
&& (audience == null || idToken.verifyAudience(audience))
&& idToken.verifyTime(clock.currentTimeMillis(), acceptableTimeSkewSeconds);

return tokenFieldsValid ? true : false;
return tokenPayload ? true : false;
}

@VisibleForTesting
Expand All @@ -280,12 +300,12 @@ boolean verifySignature(IdToken idToken) throws VerificationException {
publicKeyToUse = publicKeyCache.get(certificateLocation).get(idToken.getHeader().getKeyId());
} catch (ExecutionException | UncheckedExecutionException e) {
throw new VerificationException(
"Error fetching PublicKey from certificate location " + certificatesLocation, e);
"Error fetching public key from certificate location " + certificatesLocation, e);
}

if (publicKeyToUse == null) {
throw new VerificationException(
"Could not find PublicKey for provided keyId: " + idToken.getHeader().getKeyId());
"Could not find public key for provided keyId: " + idToken.getHeader().getKeyId());
}

try {
Expand Down Expand Up @@ -568,7 +588,7 @@ public Map<String, PublicKey> load(String certificateUrl) throws Exception {

if (keyCache.isEmpty()) {
throw new VerificationException(
"No valid public key returned the keystore: " + certificateUrl);
"No valid public key returned by the keystore: " + certificateUrl);
}

return keyCacheBuilder.build();
Expand Down