Skip to content

verify expects a specific jwtid? #581

@bencmbrook

Description

@bencmbrook

This module seems to expect the verifier to know what the "jti" is beforehand. I understand "jti" to be primarily used as a nonce to prevent replay attacks, or keeping a revocation list. The verify step, however, seems to just check that the provided jwtid matches a specific string.

"jti" reference

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions