Example for jwt.Parse uses incorrect method for validating algorithm methods #424
Description
The ExampleParse_hmac function in hmac_example_test.go provides the following example code:
Lines 51 to 59 in bc8bdca
The validation performed on line 53 seems at odds with the recommendations in the Parse function docs:
Lines 218 to 225 in bc8bdca
In this case, the type assertion tests whether token.Method can be safely converted to the *jwt.SigningMethodHMAC type. But a more specific check for HS256 seems more appropriate.
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
// hmacSampleSecret is a []byte containing your secret, e.g. []byte("my_secret_key")
return hmacSampleSecret, nil
}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}))Or for all HMAC signing methods:
validMethods := []string{
jwt.SigningMethodHS256.Alg(),
jwt.SigningMethodHS384.Alg(),
jwt.SigningMethodHS512.Alg(),
}
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
// hmacSampleSecret is a []byte containing your secret, e.g. []byte("my_secret_key")
return hmacSampleSecret, nil
}, jwt.WithValidMethods(validMethods))