From a393d549fb6b209d06d44e8b0be77e86215df3a7 Mon Sep 17 00:00:00 2001 From: Livio Amstutz Date: Tue, 6 Apr 2021 11:38:39 +0200 Subject: [PATCH] fix: decrypt of access token in token verifier (#1527) --- .../repository/eventsourcing/eventstore/token_verifier.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go index 09031577b..f492a64ee 100644 --- a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go +++ b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go @@ -2,6 +2,7 @@ package eventstore import ( "context" + "encoding/base64" "strings" "time" @@ -68,7 +69,11 @@ func (repo *TokenVerifierRepo) TokenByID(ctx context.Context, tokenID, userID st func (repo *TokenVerifierRepo) VerifyAccessToken(ctx context.Context, tokenString, clientID string) (userID string, agentID string, prefLang, resourceOwner string, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() - tokenIDSubject, err := repo.TokenVerificationKey.DecryptString([]byte(tokenString), repo.TokenVerificationKey.EncryptionKeyID()) + tokenData, err := base64.URLEncoding.DecodeString(tokenString) + if err != nil { + return "", "", "", "", caos_errs.ThrowUnauthenticated(nil, "APP-ASdgg", "invalid token") + } + tokenIDSubject, err := repo.TokenVerificationKey.DecryptString(tokenData, repo.TokenVerificationKey.EncryptionKeyID()) if err != nil { return "", "", "", "", caos_errs.ThrowUnauthenticated(nil, "APP-8EF0zZ", "invalid token") }