mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-09 14:42:59 +03:00
🐛 Bug Report: custom claims key may be overly restrictive #304
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jfroy on GitHub.
Reproduction steps
custom-claims-inputusesauto-complete-input, which has a very restrictive regular expression for input validation. There are many examples of custom claims using URLs or domains for namespacing, or just using_or-characters, that are rejected by Pocket ID's UI.Expected behavior
Custom claims keys should only be restricted by the relevant specifications. This likely means allowing any valid JSON key values, since custom claims are part of the ID Token, which is a JWT.
Actual Behavior
"Only alphanumeric characters are allowed"
Version and Environment
v0.39.0
Running on a Kubernetes cluster behind a Cilium gateway API proxy.
Log Output
No response
@jfroy commented on GitHub:
At least according to https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims, full URLs should be allowed. Possibly also URNs. So I'd say at least anything valid in percent-encoded URLs should be allowed.
But strictly reading the OpenID, JWT, and JSON specifications (which I did not in full, only sections pertaining to claims), any valid JSON key should be allowed, which is basically any valid Unicode string. So strictly based on the specs, there should be no restrictions1 on the key or the value for custom claims.
I think there are payload size limits. ↩︎
@kmendell commented on GitHub:
@jfroy would this filter fit better?
(value.length > 0 && !/^[A-Za-z0-9_\-.:]*$/.test(value))This would allow alphanumeric characters, underscores, hyphens, dots, and colons, or did i miss some?
@kmendell commented on GitHub:
ill have to defer to @stonith404 on this one, as he was the one who created the initial custom claims input.
@stonith404 commented on GitHub:
Fixed in
v0.40.1.