jws: name loose keySet options in fan-out verify error - #2085
Merged
Merged
Conversation
When verification fails after WithRequireKid(false) and/or WithInferAlgorithmFromKey(true) widened the (alg,key) candidate set, the existing "tried N key(s) but none verified successfully" error gives the operator no signal that a loose option produced the fan-out. The common mis-diagnosis is to add more keys to the JWKS, when the actual problem is either a malformed JWS or a config that's looser than the deployment needs. When the count exceeds 1 under a loose-config keySetProvider, name the option(s) that fired in the final error: "tried M (alg,key) pair(s) but none verified successfully; jws.WithRequireKid(false) and/or jws.WithInferAlgorithmFromKey(true) widened the candidate set". The default-config message and the no-keys-attempted message are unchanged. v3 backport of the v4 fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v3 backport of #2084.
When verification fails after
WithRequireKid(false)and/orWithInferAlgorithmFromKey(true)widened the per-signature candidate set, the existing "tried N key(s) but none verified successfully" error gives the operator no signal that a loose option produced the fan-out. The common mis-diagnosis is to add more keys to the JWKS, when the actual problem is either a malformed JWS or a config looser than the deployment needs.When the attempt count exceeds 1 under a loose-config
keySetProvider, name the option(s) that fired in the final error: "tried M (alg,key) pair(s) but none verified successfully; jws.WithRequireKid(false) and/or jws.WithInferAlgorithmFromKey(true) widened the candidate set". The default-config message and the zero-keys-attempted message are unchanged, so any caller matching on those continues to work.Regression test in
jws/jws_test.go:TestVerifyFanoutErrorNamesLooseOptionsbuilds a 3-key JWKS withalg=HS256set on each, signs with a 4th (un-listed) key, callsVerifywithWithKeySet(set, WithRequireKid(false)), and asserts the error contains both the count phrasing and the option name. Existing verify tests still pass.