Comments (4)
This is a source of DoS. An attacker could send random kid
values forcing upstream JWKS refresh attempts with every token.
from couper.
This is a source of DoS. An attacker could send random
kid
values forcing upstream JWKS refresh attempts with every token.
In the jwt
access control, yes.
from couper.
The lookup of unknown keys would allow to cache a JWKS response forever (which ends with the next restart). We could change the default TTL for JWKS to forever (or a much longer value than one hour) or even remove the possibility to define the TTL completely.
But in case an unknown KID is received in a token, the refresh must be synchronous and we have to hold the request until ready.
A short TTL would allow to retrieve new keys in the background without interrupting traffic - but obviously it depends on the implementation of the signer if keys are ever published well before use.
from couper.
Clients that cache keys should periodically check the JWKS for updated signing keys. Okta recommends a blended approach of regularly caching keys for performance and just-in-time checking by retrieving keys dynamically from the keys endpoint if the key read from the cache fails signature validation.
from couper.
Related Issues (20)
- end deprecation phase for permission-related features
- couper doesn't recognize PEM file format with new line at the end of a file HOT 4
- Update GH go-release-action
- Backend react to 429 status - Too Many Requests
- Fix JWT claim validation HOT 1
- Streaming a backend response-body seems to be broken with `proxy`.
- Update jwt lib HOT 4
- Update golang.org/x/net
- How to proxy a request while changing path prefix?
- duplicate CORS headers leads to browser CORS errors HOT 6
- Implement `url_decode()` function
- Multiple files sections lead to "route not found" HOT 2
- Split `jwt_token_invalid` error type: separate error type for semantic token errors HOT 1
- `backend_response` not usable in OIDC token and userinfo requests
- `seetie.MapToValue()` ignores keys starting with number
- couper-examples test configuration edge failing HOT 3
- rate limiter as access control HOT 6
- Go 1.22
- Watch roles_map_file when started in watch mode HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from couper.