Sirius/tinyauth
1
0
Fork 0
mirror of https://github.com/tinyauthapp/tinyauth.git synced 2026-08-12 03:53:32 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
ef157ae9ba3a23ccd5c09a8a291c5f4ba016d81d
tinyauth/internal
T
History
Olivier Dumont ef157ae9ba Fix critical security issue: verify JWT signature in access token validation 
The validateAccessToken method was only decoding the JWT payload without
verifying the signature, allowing attackers to forge tokens. This fix:

- Adds ValidateAccessToken method to OIDCService that properly verifies
  JWT signature using RSA public key
- Validates issuer, expiration, and required claims
- Updates controller to use the secure validation method
- Removes insecure manual JWT parsing code
2025-12-30 12:36:30 +01:00
..
assets
Add OIDC provider functionality with validation setup
2025-12-30 12:17:55 +01:00
bootstrap
Add OIDC provider functionality with validation setup
2025-12-30 12:17:55 +01:00
config
Add OIDC provider functionality with validation setup
2025-12-30 12:17:55 +01:00
controller
Fix critical security issue: verify JWT signature in access token validation
2025-12-30 12:36:30 +01:00
middleware
feat: forward sub from oidc providers (#543)
2025-12-26 19:02:51 +02:00
model
Add OIDC provider functionality with validation setup
2025-12-30 12:17:55 +01:00
service
Fix critical security issue: verify JWT signature in access token validation
2025-12-30 12:36:30 +01:00
utils
Add OIDC provider functionality with validation setup
2025-12-30 12:17:55 +01:00