Sirius/tinyauth
1
0
Fork 0
mirror of https://github.com/tinyauthapp/tinyauth.git synced 2026-08-25 23:03:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
ef157ae9ba3a23ccd5c09a8a291c5f4ba016d81d
tinyauth/internal/service
T
History
Olivier Dumont ef157ae9ba Fix critical security issue: verify JWT signature in access token validation 
The validateAccessToken method was only decoding the JWT payload without
verifying the signature, allowing attackers to forge tokens. This fix:

- Adds ValidateAccessToken method to OIDCService that properly verifies
  JWT signature using RSA public key
- Validates issuer, expiration, and required claims
- Updates controller to use the secure validation method
- Removes insecure manual JWT parsing code
2025-12-30 12:36:30 +01:00
..
access_controls_service.go
refactor: use proper module name (#542)
2025-12-26 17:53:24 +02:00
auth_service.go
feat: forward sub from oidc providers (#543)
2025-12-26 19:02:51 +02:00
database_service.go
refactor: use proper module name (#542)
2025-12-26 17:53:24 +02:00
docker_service.go
refactor: use proper module name (#542)
2025-12-26 17:53:24 +02:00
generic_oauth_service.go
refactor: use proper module name (#542)
2025-12-26 17:53:24 +02:00
github_oauth_service.go
feat: forward sub from oidc providers (#543)
2025-12-26 19:02:51 +02:00
google_oauth_service.go
feat: forward sub from oidc providers (#543)
2025-12-26 19:02:51 +02:00
ldap_service.go
refactor: don't export non-needed fields (#336)
2025-09-02 01:27:55 +03:00
oauth_broker_service.go
refactor: use proper module name (#542)
2025-12-26 17:53:24 +02:00
oidc_service.go
Fix critical security issue: verify JWT signature in access token validation
2025-12-30 12:36:30 +01:00