andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-21 06:54:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source
This commit is contained in:
Tim Möhlmann
2026-02-16 10:25:19 +01:00
committed by GitHub
parent b5d7518ad1
commit feab8e1fa3
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/authz/repository/eventsourcing/eventstore/token_verifier.go
+7 -2
View File
@@ -98,7 +98,7 @@ func (repo *TokenVerifierRepo) VerifyAccessToken(ctx context.Context, tokenStrin
return "", "", "", "", "", zerrors.ThrowUnauthenticated(nil, "APP-Reb32", "invalid token")
}
if strings.HasPrefix(tokenID, command.IDPrefixV2) {
return repo.verifyAccessTokenV2(ctx, tokenID, verifierClientID, projectID)
return repo.verifyAccessTokenV2(ctx, tokenID, subject, verifierClientID, projectID)
}
if sessionID, ok := strings.CutPrefix(tokenID, authz.SessionTokenPrefix); ok {
userID, clientID, resourceOwner, err = repo.verifySessionToken(ctx, sessionID, tokenString)
@@ -132,7 +132,7 @@ func (repo *TokenVerifierRepo) verifyAccessTokenV1(ctx context.Context, tokenID,
return token.UserID, token.UserAgentID, token.ApplicationID, token.PreferredLanguage, token.ResourceOwner, nil
}
func (repo *TokenVerifierRepo) verifyAccessTokenV2(ctx context.Context, token, verifierClientID, projectID string) (userID, agentID, clientID, prefLang, resourceOwner string, err error) {
func (repo *TokenVerifierRepo) verifyAccessTokenV2(ctx context.Context, token, subject, verifierClientID, projectID string) (userID, agentID, clientID, prefLang, resourceOwner string, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
@@ -146,6 +146,11 @@ func (repo *TokenVerifierRepo) verifyAccessTokenV2(ctx context.Context, token, v
if err = verifyAudience(activeToken.Audience, verifierClientID, projectID); err != nil {
return "", "", "", "", "", err
}
// If the subject doesn't match the userID from the database, the token probably got tampered with or truncated.
// See https://github.com/zitadel/zitadel/security/advisories/GHSA-6mq3-xmgp-pjm5
if activeToken.UserID != subject {
return "", "", "", "", "", zerrors.ThrowUnauthenticated(nil, "APP-3f4fs", "invalid token")
}
if err = repo.checkAuthentication(ctx, activeToken.AuthMethods, activeToken.UserID); err != nil {
return "", "", "", "", "", err
}