]> git.kaiwu.me - haproxy.git/commit
projects / haproxy.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b38e248) | patch
MEDIUM: jwt: Reject "none" alg in jwt_verify by default
authorRemi Tricot-Le Breton <rlebreton@haproxy.com>
Tue, 8 Sep 2026 13:06:24 +0000 (15:06 +0200)
committerWilliam Lallemand <wlallemand@haproxy.com>
Fri, 11 Sep 2026 12:44:39 +0000 (14:44 +0200)
commit3a62334bb5b07c0dff23fe83898b66507b65ceb6
treece954b875e736d0992046decb87ce009fbcf26f5tree | snapshot
parentb38e2483f1e256de7078c2d6531a1db657aeb7a3commit | diff
MEDIUM: jwt: Reject "none" alg in jwt_verify by default

In RFC8725 section 3.2, they specify that "JWT libraries SHOULD NOT
consume JWTs using "none" unless explicitly requested by the caller".
This patch disables the support for the "none" algorithm by default in
jwt_verify converter and adds a global option that explicitely allows
it.
doc/configuration.txt diff | blob | history
reg-tests/jwt/jws_verify.vtc diff | blob | history
src/jwt.c diff | blob | history
haproxy upstream