don't allow if match path is missing

yaacov · yaacov · commit b2414ae63673 · 2021-03-07T08:17:21.000+02:00
diff --git a/pkg/proxy/token.go b/pkg/proxy/token.go
@@ -60,7 +60,8 @@ func validateToken(token string, secret []byte, publicKey *rsa.PublicKey, apiPat
 			matchMethod = ""
 		}
 		if matchPath, ok = claims["matchPath"].(string); !ok {
-			matchPath = ""
+			// Do not allow any request
+			matchPath = "^$"
 		}
 		matchPathRegexp := regexp.MustCompile(matchPath)
 

Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,8 @@ func validateToken(token string, secret []byte, publicKey *rsa.PublicKey, apiPat`
`60`	`60`	`matchMethod = ""`
`61`	`61`	`}`
`62`	`62`	`if matchPath, ok = claims["matchPath"].(string); !ok {`
`63`		`- matchPath = ""`
	`63`	`+ // Do not allow any request`
	`64`	`+ matchPath = "^$"`
`64`	`65`	`}`
`65`	`66`	`matchPathRegexp := regexp.MustCompile(matchPath)`
`66`	`67`