Skip to content

feat(auth): use a standardized trait to read nonce instead of passing function #2589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
peterpeterparker merged 1 commit into from
Feb 12, 2026
Merged

feat(auth): use a standardized trait to read nonce instead of passing function #2589

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/libs/auth/src/openid/credentials/delegation/impls.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,8 @@ impl JwtClaims for DelegationClaims {
fn iat(&self) -> Option<u64> {
self.iat
}

fn nonce(&self) -> Option<&str> {
self.nonce.as_deref()
}
}
19 changes: 2 additions & 17 deletions src/libs/auth/src/openid/credentials/delegation/verify.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,14 +58,6 @@ fn verify_openid_credentials(
client_id: &OpenIdAuthProviderClientId,
salt: &Salt,
) -> VerifyOpenIdDelegationCredentialsResult {
let assert_nonce = |claims: &DelegationClaims, nonce: &String| -> Result<(), JwtVerifyError> {
if claims.nonce.as_deref() != Some(nonce.as_str()) {
return Err(JwtVerifyError::BadClaim("nonce".to_string()));
}

Ok(())
};

let assert_audience = |claims: &DelegationClaims| -> Result<(), JwtVerifyError> {
if claims.aud != client_id.as_str() {
return Err(JwtVerifyError::BadClaim("aud".to_string()));
Expand All @@ -74,15 +66,8 @@ fn verify_openid_credentials(
Ok(())
};

let token = verify_openid_jwt(
jwt,
provider.issuers(),
&jwks.keys,
salt,
assert_nonce,
assert_audience,
)
.map_err(VerifyOpenidCredentialsError::JwtVerify)?;
let token = verify_openid_jwt(jwt, provider.issuers(), &jwks.keys, salt, assert_audience)
.map_err(VerifyOpenidCredentialsError::JwtVerify)?;

let credential = OpenIdDelegationCredential::from(token);

Expand Down
1 change: 1 addition & 0 deletions src/libs/auth/src/openid/jwt/types.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ pub(crate) mod token {

pub trait JwtClaims {
fn iat(&self) -> Option<u64>;
fn nonce(&self) -> Option<&str>;
}

#[derive(Clone, Deserialize)]
Expand Down
41 changes: 10 additions & 31 deletions src/libs/auth/src/openid/jwt/verify.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,15 @@ fn pick_key<'a>(kid: &str, jwks: &'a [Jwk]) -> Option<&'a Jwk> {
jwks.iter().find(|j| j.kid.as_deref() == Some(kid))
}

pub fn verify_openid_jwt<Claims, Nonce, Custom>(
pub fn verify_openid_jwt<Claims, Custom>(
jwt: &str,
issuers: &[&str],
jwks: &[Jwk],
salt: &Salt,
assert_nonce: Nonce,
assert_custom: Custom,
) -> Result<TokenData<Claims>, JwtVerifyError>
where
Claims: DeserializeOwned + JwtClaims,
Nonce: FnOnce(&Claims, &String) -> Result<(), JwtVerifyError>,
Custom: FnOnce(&Claims) -> Result<(), JwtVerifyError>,
{
// 1) Read header to get `kid`
Expand Down Expand Up @@ -68,9 +66,12 @@ where
let c = &token.claims;

// 6) Checks the nonce - i.e. the caller + salt is present in the jwt
// This ensures the JWT has not been intercepted and submitted with a different identity.
let nonce = build_nonce(salt);

assert_nonce(c, &nonce)?;
if c.nonce() != Some(nonce.as_str()) {
return Err(JwtVerifyError::BadClaim("nonce".to_string()));
}

// 7) Assert custom fields according consumer's flow
assert_custom(c)?;
Expand Down Expand Up @@ -177,6 +178,9 @@ mod verify_tests {
fn iat(&self) -> Option<u64> {
self.iat
}
fn nonce(&self) -> Option<&str> {
self.nonce.as_deref()
}
}

fn claims(
Expand Down Expand Up @@ -222,13 +226,6 @@ mod verify_tests {
}
}

fn assert_nonce(claims: &GoogleClaims, nonce: &String) -> Result<(), JwtVerifyError> {
if claims.nonce.as_deref() != Some(nonce.as_str()) {
return Err(JwtVerifyError::BadClaim("nonce".to_string()));
}
Ok(())
}

fn assert_audience(claims: &GoogleClaims) -> Result<(), JwtVerifyError> {
if claims.aud != AUD_OK {
return Err(JwtVerifyError::BadClaim("aud".to_string()));
Expand Down Expand Up @@ -260,7 +257,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.expect("should verify");
Expand Down Expand Up @@ -294,7 +290,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -325,7 +320,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -357,7 +351,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -388,7 +381,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -419,7 +411,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -448,7 +439,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -480,7 +470,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -512,7 +501,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -545,7 +533,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
Expand Down Expand Up @@ -587,15 +574,8 @@ mod verify_tests {
}),
};

let err = verify_openid_jwt(
&token,
&[ISS_GOOGLE],
&[bad_jwk],
&salt,
assert_nonce,
assert_audience,
)
.unwrap_err();
let err = verify_openid_jwt(&token, &[ISS_GOOGLE], &[bad_jwk], &salt, assert_audience)
.unwrap_err();
assert!(matches!(err, JwtVerifyError::BadSig(_)));
}

Expand Down Expand Up @@ -630,7 +610,6 @@ mod verify_tests {
&[ISS_GOOGLE],
&[jwk_with_kid(KID_OK)],
&salt,
assert_nonce,
assert_audience,
)
.expect("should verify");
Expand Down