starred/pocket-id-pocket-id-1
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-09 14:53:00 +03:00
Code Issues 122 Packages Projects Releases 10 Wiki Activity

🐛 Bug Report: custom claims key may be overly restrictive #299

New Issue
Closed
opened 2025-10-08 00:02:07 +03:00 by OVERLORD · 4 comments
OVERLORD commented 2025-10-08 00:02:07 +03:00
Owner
Copy Link

Originally created by @jfroy on GitHub.

Reproduction steps

custom-claims-input uses auto-complete-input, which has a very restrictive regular expression for input validation. There are many examples of custom claims using URLs or domains for namespacing, or just using _ or - characters, that are rejected by Pocket ID's UI.

Expected behavior

Custom claims keys should only be restricted by the relevant specifications. This likely means allowing any valid JSON key values, since custom claims are part of the ID Token, which is a JWT.

Actual Behavior

"Only alphanumeric characters are allowed"

Image

Version and Environment

v0.39.0

Running on a Kubernetes cluster behind a Cilium gateway API proxy.

Log Output

No response

Originally created by @jfroy on GitHub. ### Reproduction steps `custom-claims-input` uses `auto-complete-input`, which has a very restrictive regular expression for input validation. There are many examples of custom claims using URLs or domains for namespacing, or just using `_` or `-` characters, that are rejected by Pocket ID's UI. ### Expected behavior Custom claims keys should only be restricted by the relevant specifications. This likely means allowing any valid JSON key values, since custom claims are part of the [ID Token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken), which is a [JWT](https://www.rfc-editor.org/rfc/rfc7519.html). ### Actual Behavior "Only alphanumeric characters are allowed" ![Image](https://github.com/user-attachments/assets/7e95611a-65eb-4ae9-ae1b-951776cf5e1c) ### Version and Environment v0.39.0 Running on a Kubernetes cluster behind a Cilium gateway API proxy. ### Log Output _No response_
OVERLORD added the bug label 2025-10-08 00:02:07 +03:00
OVERLORD commented 2025-10-08 00:02:09 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Fixed in v0.40.1.

@stonith404 commented on GitHub: Fixed in `v0.40.1`.
OVERLORD commented 2025-10-08 00:02:09 +03:00
Author
Owner
Copy Link

@kmendell commented on GitHub:

@jfroy would this filter fit better? (value.length > 0 && !/^[A-Za-z0-9_\-.:]*$/.test(value))

This would allow alphanumeric characters, underscores, hyphens, dots, and colons, or did i miss some?

@kmendell commented on GitHub: @jfroy would this filter fit better? `(value.length > 0 && !/^[A-Za-z0-9_\-.:]*$/.test(value))` This would allow alphanumeric characters, underscores, hyphens, dots, and colons, or did i miss some?
OVERLORD commented 2025-10-08 00:02:10 +03:00
Author
Owner
Copy Link

@kmendell commented on GitHub:

ill have to defer to @stonith404 on this one, as he was the one who created the initial custom claims input.

@kmendell commented on GitHub: ill have to defer to @stonith404 on this one, as he was the one who created the initial custom claims input.
OVERLORD commented 2025-10-08 00:02:10 +03:00
Author
Owner
Copy Link

@jfroy commented on GitHub:

At least according to https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims, full URLs should be allowed. Possibly also URNs. So I'd say at least anything valid in percent-encoded URLs should be allowed.

But strictly reading the OpenID, JWT, and JSON specifications (which I did not in full, only sections pertaining to claims), any valid JSON key should be allowed, which is basically any valid Unicode string. So strictly based on the specs, there should be no restrictions1 on the key or the value for custom claims.

  1. I think there are payload size limits. ↩︎

@jfroy commented on GitHub: At least according to https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims, full URLs should be allowed. Possibly also URNs. So I'd say at least anything valid in percent-encoded URLs should be allowed. But strictly reading the OpenID, JWT, and [JSON](https://www.rfc-editor.org/rfc/rfc7159) specifications (which I did not in full, only sections pertaining to claims), _any valid JSON key_ should be allowed, which is basically any valid Unicode string. So strictly based on the specs, there should be no restrictions[^1] on the key or the value for custom claims. [^1]: I think there are payload size limits.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-1#299
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?