From f75c7b74dc4c2f38ad9e61e08dfe9fd1fc0686f9 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Tue, 22 Sep 2026 06:37:12 +1000 Subject: https: T8989: Hotfix to enforce audience settings with OIDC is configured --- src/services/api/rest/libs/token_auth.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'src/services/api') diff --git a/src/services/api/rest/libs/token_auth.py b/src/services/api/rest/libs/token_auth.py index e0710cc20..ccc5fbf35 100644 --- a/src/services/api/rest/libs/token_auth.py +++ b/src/services/api/rest/libs/token_auth.py @@ -56,10 +56,16 @@ def verify_oidc_token(token: str): issuer=state.oidc_issuer, leeway=30, ) - if state.oidc_audience: - decode_kwargs["audience"] = state.oidc_audience - else: - decode_options["verify_aud"] = False + if not state.oidc_audience: + # Fail closed: config-time validation in service_https.py's + # verify() requires oidc.audience whenever oidc.issuer is + # set, but never trust that alone for a security-critical + # check. PyJWT also skips aud validation whenever no + # "audience" kwarg is passed at all, independent of + # verify_aud -- so this must refuse outright, not just stop + # forcing verify_aud=False. + return None + decode_kwargs["audience"] = state.oidc_audience payload = jwt.decode(token, signing_key.key, **decode_kwargs) return payload.get("sub") or payload.get("client_id") except Exception: -- cgit v1.2.3