Skip to content

Commit 5714c7f

Browse files
dbaxadbaxa
committed
Sem-Ver: api-break Disable jti uniqueness checking by default.
Signed-off-by: David Black <dblack@atlassian.com>
1 parent 6bdb3b9 commit 5714c7f

6 files changed

Lines changed: 50 additions & 14 deletions

File tree

‎atlassian_jwt_auth/frameworks/common/backend.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ class Backend():
4545
'ASAP_SUBJECT_SHOULD_MATCH_ISSUER': None,
4646

4747
# Enforce that tokens have a unique JTI
48+
# Set this to True to enforce JTI uniqueness checking.
4849
'ASAP_CHECK_JTI_UNIQUENESS': None,
4950
}
5051

‎atlassian_jwt_auth/frameworks/django/tests/test_django.py‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,8 @@ def check_response(self,
9494
def test_request_with_valid_token_is_allowed(self):
9595
self.check_response('needed', 'one', 200)
9696

97-
def test_request_with_duplicate_jti_is_rejected(self):
97+
def test_request_with_duplicate_jti_is_rejected_as_per_setting(self):
98+
self.test_settings['ASAP_CHECK_JTI_UNIQUENESS'] = True
9899
token = create_token(
99100
issuer='client-app', audience='server-app',
100101
key_id='client-app/key01', private_key=self._private_key_pem
@@ -104,8 +105,7 @@ def test_request_with_duplicate_jti_is_rejected(self):
104105
self.check_response('needed', 'duplicate jti', 401,
105106
authorization=str_auth)
106107

107-
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
108-
self.test_settings['ASAP_CHECK_JTI_UNIQUENESS'] = False
108+
def _assert_request_with_duplicate_jti_is_accepted(self):
109109
token = create_token(
110110
issuer='client-app', audience='server-app',
111111
key_id='client-app/key01', private_key=self._private_key_pem
@@ -114,6 +114,13 @@ def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
114114
self.check_response('needed', 'one', 200, authorization=str_auth)
115115
self.check_response('needed', 'one', 200, authorization=str_auth)
116116

117+
def test_request_with_duplicate_jti_is_accepted(self):
118+
self._assert_request_with_duplicate_jti_is_accepted()
119+
120+
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
121+
self.test_settings['ASAP_CHECK_JTI_UNIQUENESS'] = False
122+
self._assert_request_with_duplicate_jti_is_accepted()
123+
117124
def test_request_with_string_headers_is_allowed(self):
118125
token = create_token(
119126
issuer='client-app', audience='server-app',

‎atlassian_jwt_auth/frameworks/flask/tests/test_flask.py‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,23 +64,30 @@ def test_request_with_valid_token_is_allowed(self):
6464
)
6565
self.assertEqual(self.send_request(token).status_code, 200)
6666

67-
def test_request_with_duplicate_jti_is_rejected(self):
67+
def test_request_with_duplicate_jti_is_rejected_as_per_setting(self):
68+
self.app.config['ASAP_CHECK_JTI_UNIQUENESS'] = True
6869
token = create_token(
6970
'client-app', 'server-app',
7071
'client-app/key01', self._private_key_pem
7172
)
7273
self.assertEqual(self.send_request(token).status_code, 200)
7374
self.assertEqual(self.send_request(token).status_code, 401)
7475

75-
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
76-
self.app.config['ASAP_CHECK_JTI_UNIQUENESS'] = False
76+
def _assert_request_with_duplicate_jti_is_accepted(self):
7777
token = create_token(
7878
'client-app', 'server-app',
7979
'client-app/key01', self._private_key_pem
8080
)
8181
self.assertEqual(self.send_request(token).status_code, 200)
8282
self.assertEqual(self.send_request(token).status_code, 200)
8383

84+
def test_request_with_duplicate_jti_is_accepted(self):
85+
self._assert_request_with_duplicate_jti_is_accepted()
86+
87+
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
88+
self.app.config['ASAP_CHECK_JTI_UNIQUENESS'] = False
89+
self._assert_request_with_duplicate_jti_is_accepted()
90+
8491
def test_request_with_invalid_audience_is_rejected(self):
8592
token = create_token(
8693
'client-app', 'invalid-audience',

‎atlassian_jwt_auth/frameworks/wsgi/tests/test_wsgi.py‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,8 @@ def test_request_with_valid_token_is_allowed(self):
6161
self.assertEqual(resp_info['status'], '200 OK')
6262
self.assertIn('ATL_ASAP_CLAIMS', environ)
6363

64-
def test_request_with_duplicate_jti_is_rejected(self):
64+
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
65+
self.config['ASAP_CHECK_JTI_UNIQUENESS'] = True
6566
token = create_token(
6667
'client-app', 'server-app',
6768
'client-app/key01', self._private_key_pem
@@ -74,12 +75,11 @@ def test_request_with_duplicate_jti_is_rejected(self):
7475
token=token, application=application)
7576
self.assertEqual(resp_info['status'], '401 Unauthorized')
7677

77-
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
78+
def _assert_request_with_duplicate_jti_is_accepted(self):
7879
token = create_token(
7980
'client-app', 'server-app',
8081
'client-app/key01', self._private_key_pem
8182
)
82-
self.config['ASAP_CHECK_JTI_UNIQUENESS'] = False
8383
application = self.get_app_with_middleware(self.config)
8484
body, resp_info, environ = self.send_request(
8585
token=token, application=application)
@@ -88,6 +88,13 @@ def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
8888
token=token, application=application)
8989
self.assertEqual(resp_info['status'], '200 OK')
9090

91+
def test_request_with_duplicate_jti_is_accepted(self):
92+
self._assert_request_with_duplicate_jti_is_accepted()
93+
94+
def test_request_with_duplicate_jti_is_accepted_as_per_setting(self):
95+
self.config['ASAP_CHECK_JTI_UNIQUENESS'] = False
96+
self._assert_request_with_duplicate_jti_is_accepted()
97+
9198
def test_request_with_invalid_audience_is_rejected(self):
9299
token = create_token(
93100
'client-app', 'invalid-audience',

‎atlassian_jwt_auth/tests/test_verifier.py‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,8 @@ def test_verify_jwt_with_jwt_with_already_seen_jti(self):
9797
""" tests that verify_jwt rejects a jwt if the jti
9898
has already been seen.
9999
"""
100-
verifier = self._setup_jwt_auth_verifier(self._public_key_pem)
100+
verifier = self._setup_jwt_auth_verifier(
101+
self._public_key_pem, check_jti_uniqueness=True)
101102
a_jwt = self._jwt_auth_signer.generate_jwt(
102103
self._example_aud)
103104
self.assertIsNotNone(verifier.verify_jwt(
@@ -109,6 +110,12 @@ def test_verify_jwt_with_jwt_with_already_seen_jti(self):
109110
with self.assertRaisesRegexp(exception, 'has already been used'):
110111
verifier.verify_jwt(a_jwt, self._example_aud)
111112

113+
def assert_jwt_accepted_more_than_once(self, verifier, a_jwt):
114+
""" asserts that the given jwt is accepted more than once. """
115+
for i in range(0, 3):
116+
self.assertIsNotNone(
117+
verifier.verify_jwt(a_jwt, self._example_aud))
118+
112119
def test_verify_jwt_with_already_seen_jti_with_uniqueness_disabled(self):
113120
""" tests that verify_jwt accepts a jwt if the jti
114121
has already been seen and the verifier has been set
@@ -117,9 +124,16 @@ def test_verify_jwt_with_already_seen_jti_with_uniqueness_disabled(self):
117124
verifier = self._setup_jwt_auth_verifier(
118125
self._public_key_pem, check_jti_uniqueness=False)
119126
a_jwt = self._jwt_auth_signer.generate_jwt(self._example_aud)
120-
for i in range(0, 3):
121-
self.assertIsNotNone(
122-
verifier.verify_jwt(a_jwt, self._example_aud))
127+
self.assert_jwt_accepted_more_than_once(verifier, a_jwt)
128+
129+
def test_verify_jwt_with_already_seen_jti_default(self):
130+
""" tests that verify_jwt by default accepts a jwt if the jti
131+
has already been seen.
132+
"""
133+
verifier = self._setup_jwt_auth_verifier(
134+
self._public_key_pem)
135+
a_jwt = self._jwt_auth_signer.generate_jwt(self._example_aud)
136+
self.assert_jwt_accepted_more_than_once(verifier, a_jwt)
123137

124138
def test_verify_jwt_subject_should_match_issuer(self):
125139
verifier = self._setup_jwt_auth_verifier(

‎atlassian_jwt_auth/verifier.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ def __init__(self, public_key_retriever, **kwargs):
1818
self._subject_should_match_issuer = kwargs.get(
1919
'subject_should_match_issuer', True)
2020
self._check_jti_uniqueness = kwargs.get(
21-
'check_jti_uniqueness', True)
21+
'check_jti_uniqueness', False)
2222

2323
def verify_jwt(self, a_jwt, audience, leeway=0, **requests_kwargs):
2424
"""Verify if the token is correct

0 commit comments

Comments
 (0)