Skip to content

fix: remove unneeded jwt nonce #2015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 24, 2022
Merged

fix: remove unneeded jwt nonce #2015

merged 1 commit into from
May 24, 2022

Conversation

BruceMacD
Copy link
Collaborator

Summary

This nonce claim is not needed and never used, it is from a very early version of Infra. The nonce is useful when preventing replay attacks (ex: an implicit OAuth flow), but not useful on JWTs that will be used repeatedly.

Checklist

  • Wrote appropriate unit tests
  • Considered security implications of the change
  • Updated associated docs where necessary
  • Updated associated configuration where necessary
  • Change is backwards compatible if it needs to be (user can upgrade without manual steps?)
  • Nothing sensitive logged
  • Considered data migrations for smooth upgrades

Related Issues

Resolves #2014

@BruceMacD BruceMacD closed this May 20, 2022
@BruceMacD BruceMacD reopened this May 24, 2022
@BruceMacD BruceMacD merged commit 157e558 into main May 24, 2022
@BruceMacD BruceMacD deleted the brucemacd/jwt-nonce branch May 24, 2022 13:54
@infrahq-ci infrahq-ci mentioned this pull request May 24, 2022
Merged
BruceMacD added a commit that referenced this pull request May 26, 2022
@BruceMacD
Revert "fix: remove unneeded jwt nonce (#2015)"
1bb9b46 
This reverts commit 157e558.
BruceMacD added a commit that referenced this pull request May 26, 2022
@BruceMacD
fix: keep jwt nonce for version compatibility (#2086)
172641d 
* Revert "fix: remove unneeded jwt nonce (#2015)"
This reverts commit 157e558.
* fix: keep jwt nonce for version compatibility
@infrahq-ci infrahq-ci mentioned this pull request Jul 7, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jmorganca jmorganca jmorganca approved these changes

@dnephin dnephin Awaiting requested review from dnephin

@pdevine pdevine Awaiting requested review from pdevine

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Remove unused JWT claim
2 participants
@BruceMacD @jmorganca