Skip to content

Fix JwtSecurityToken Missing Mapping When Creating a Token. #2578

Merged
FuPingFranco merged 16 commits into
devfrom
francofung/FixEncryptionInteropWrapper
May 20, 2024
Merged

Fix JwtSecurityToken Missing Mapping When Creating a Token. #2578
FuPingFranco merged 16 commits into
devfrom
francofung/FixEncryptionInteropWrapper

Conversation

@FuPingFranco

Copy link
Copy Markdown
Contributor

Description

Adds mapping to Algorithm (alg) so it should be one of the registered at IANA "JSON Web Signature and Encryption Algorithms" (https://www.iana.org/assignments/jose/jose.xhtml) as described on topic 4.1.1 of RFC7516 (https://datatracker.ietf.org/doc/html/rfc7516#page-12).

Fixes #2089

@FuPingFranco FuPingFranco requested a review from a team as a code owner May 1, 2024 20:57
Comment thread test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerTests.cs Outdated
Comment thread test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerTests.cs Outdated
Comment thread src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs Outdated
Comment thread src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs Outdated
Comment thread src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs
Comment thread src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs Outdated
Comment thread test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerTests.cs Outdated
Comment thread test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerTests.cs Outdated
@FuPingFranco FuPingFranco requested a review from pmaytak May 15, 2024 21:45
Comment thread src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs
Comment thread src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs
FuPingFranco and others added 3 commits May 16, 2024 10:40
…dlerNonParallelRunTests.cs

Co-authored-by: kellyyangsong <69649063+kellyyangsong@users.noreply.github.com>
…dlerTests.WithContextSwitches.cs

Co-authored-by: kellyyangsong <69649063+kellyyangsong@users.noreply.github.com>
@FuPingFranco FuPingFranco requested a review from JoshLozensky May 16, 2024 17:55
JsonWebToken jsonToken = tokenHandler.ReadToken(token) as JsonWebToken;

Assert.NotNull(jsonToken);
Assert.Equal(jsonToken._alg, SecurityAlgorithms.RsaOaepKeyWrap);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use jsonWebToken.Alg?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The underscore variables should really be private...

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was curious why were they not private when working on them? I changed it to use 'Alg' same as in JwtSecurityTokenHandler. Thanks Brent & Peter!

Comment thread src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs
Comment thread src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs Outdated
Comment thread src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] JWE header alg attribute with value http://www.w3.org/2001/04/xmlenc#rsa-oaep instead of RSA-OAEP

6 participants