gogrlx/nats-server
1
0
Fork 0
mirror of https://github.com/gogrlx/nats-server.git synced 2026-04-02 03:38:42 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix JWT claims update if headers are passed in request

Browse Source 
Claims update message requires only payload to be passed,
but passing headers should not fail the request.
This change ensures we extract payload from raw message
before decoding it.
Before this change, passing claims update with headers
would return cryptic `expected x chunks` error.

Signed-off-by: Tomasz Pietrek <tomasz@nats.io>
This commit is contained in:
Tomasz Pietrek
2023-02-28 09:39:00 +01:00
parent 1db3934b46
commit 8732022d26
2 changed files with 63 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
server/accounts.go
View File

@@ -3902,7 +3902,10 @@ func (dr *DirAccResolver) Start(s *Server) error {
return fmt.Errorf("error setting up update handling: %v", err)
}
}
if _, err := s.sysSubscribe(accClaimsReqSubj, func(_ *subscription, _ *client, _ *Account, subj, resp string, msg []byte) {
if _, err := s.sysSubscribe(accClaimsReqSubj, func(_ *subscription, c *client, _ *Account, _, resp string, msg []byte) {
// As this is a raw message, we need to extract payload and only decode claims from it,
// in case request is sent with headers.
_, msg = c.msgParts(msg)
if claim, err := jwt.DecodeAccountClaims(string(msg)); err != nil {
respondToUpdate(s, resp, "n/a", "jwt update resulted in error", err)
} else if claim.Issuer == op && strict {
@@ -4190,7 +4193,10 @@ func (dr *CacheDirAccResolver) Start(s *Server) error {
return fmt.Errorf("error setting up update handling: %v", err)
}
}
if _, err := s.sysSubscribe(accClaimsReqSubj, func(_ *subscription, _ *client, _ *Account, subj, resp string, msg []byte) {
if _, err := s.sysSubscribe(accClaimsReqSubj, func(_ *subscription, c *client, _ *Account, _, resp string, msg []byte) {
// As this is a raw message, we need to extract payload and only decode claims from it,
// in case request is sent with headers.
_, msg = c.msgParts(msg)
if claim, err := jwt.DecodeAccountClaims(string(msg)); err != nil {
respondToUpdate(s, resp, "n/a", "jwt update cache resulted in error", err)
} else if claim.Issuer == op && strict {

55
server/jwt_test.go
View File

@@ -6132,6 +6132,61 @@ func TestJWTAccountProtectedImport(t *testing.T) {
})
}
// Headers are ignored in claims update, but passing them should not cause error.
func TestJWTClaimsUpdateWithHeaders(t *testing.T) {
skp, spub := createKey(t)
newUser(t, skp)
sclaim := jwt.NewAccountClaims(spub)
encodeClaim(t, sclaim, spub)
akp, apub := createKey(t)
newUser(t, akp)
claim := jwt.NewAccountClaims(apub)
jwtClaim := encodeClaim(t, claim, apub)
dirSrv := t.TempDir()
conf := createConfFile(t, []byte(fmt.Sprintf(`
listen: 127.0.0.1:-1
operator: %s
system_account: %s
resolver: {
type: full
dir: '%s'
}
`, ojwt, spub, dirSrv)))
s, _ := RunServerWithConfig(conf)
defer s.Shutdown()
type zapi struct {
Server *ServerInfo
Data *Connz
Error *ApiError
}
sc := natsConnect(t, s.ClientURL(), createUserCreds(t, s, skp))
defer sc.Close()
// Pass claims update with headers.
msg := &nats.Msg{
Subject: "$SYS.REQ.CLAIMS.UPDATE",
Data: []byte(jwtClaim),
Header: map[string][]string{"key": {"value"}},
}
resp, err := sc.RequestMsg(msg, time.Second)
if err != nil {
t.Fatalf("Unexpected error: %v", err)
}
var cz zapi
if err := json.Unmarshal(resp.Data, &cz); err != nil {
t.Fatalf("Unexpected error: %v", err)
}
if cz.Error != nil {
t.Fatalf("Unexpected error: %+v", cz.Error)
}
}
func TestJWTMappings(t *testing.T) {
sysKp, syspub := createKey(t)
sysJwt := encodeClaim(t, jwt.NewAccountClaims(syspub), syspub)