@@ -17,9 +17,11 @@ import (
1717)
1818
1919type jwksTester struct {
20- privateKey * rsa.PrivateKey
21- keyId string
22- jwksUrl string
20+ invalidKey * rsa.PrivateKey
21+ privateKey * rsa.PrivateKey
22+ invalidKeyId string
23+ keyId string
24+ jwksUrl string
2325}
2426
2527func (t * jwksTester ) jwksHandler (w http.ResponseWriter , r * http.Request ) {
@@ -51,9 +53,17 @@ func setupJwksForTest() (*jwksTester, func()) {
5153 }
5254 kid := keyFingerprint (key )
5355
56+ invalidKey , err := rsa .GenerateKey (rand .Reader , 2048 )
57+ if err != nil {
58+ panic (err )
59+ }
60+ invalidKid := keyFingerprint (invalidKey )
61+
5462 tn := jwksTester {
55- privateKey : key ,
56- keyId : kid ,
63+ invalidKey : invalidKey ,
64+ privateKey : key ,
65+ invalidKeyId : invalidKid ,
66+ keyId : kid ,
5767 }
5868
5969 s := tn .startJwksServer ()
@@ -104,10 +114,11 @@ func TestJwksValidation(t *testing.T) {
104114 defer closer ()
105115
106116 tests := []struct {
107- name string
108- claims jwt.MapClaims
109- hasKeyId bool
110- success bool
117+ name string
118+ claims jwt.MapClaims
119+ hasKeyId bool
120+ success bool
121+ invalidKey bool
111122 }{
112123 {
113124 name : "valid token" ,
@@ -142,9 +153,36 @@ func TestJwksValidation(t *testing.T) {
142153 "exp" : time .Now ().Add (time .Minute ).Unix (),
143154 "iat" : time .Now ().Unix (),
144155 },
145- success : false , // kid is technically optional, the keyfunc library requires it
156+ // the keyfunc v3.5.0+ no longer requires a kid to find the key
157+ success : true ,
146158 hasKeyId : false ,
147159 },
160+ {
161+ name : "invalidKey key" ,
162+ claims : jwt.MapClaims {
163+ "aud" : "test-svc" ,
164+ "iss" : "https://test-svc" ,
165+ "sub" : "1234567890" ,
166+ "exp" : time .Now ().Add (time .Minute ).Unix (),
167+ "iat" : time .Now ().Unix (),
168+ },
169+ success : false ,
170+ hasKeyId : true ,
171+ invalidKey : true ,
172+ },
173+ {
174+ name : "invalidKey key missing kid" ,
175+ claims : jwt.MapClaims {
176+ "aud" : "test-svc" ,
177+ "iss" : "https://test-svc" ,
178+ "sub" : "1234567890" ,
179+ "exp" : time .Now ().Add (time .Minute ).Unix (),
180+ "iat" : time .Now ().Unix (),
181+ },
182+ success : false ,
183+ hasKeyId : false ,
184+ invalidKey : true ,
185+ },
148186 {
149187 name : "expired token missing kid" ,
150188 claims : jwt.MapClaims {
@@ -162,11 +200,20 @@ func TestJwksValidation(t *testing.T) {
162200 for _ , tt := range tests {
163201 t .Run (
164202 tt .name , func (t * testing.T ) {
203+ var tokenString string
204+ var err error
165205 token := jwt .NewWithClaims (jwt .SigningMethodRS256 , tt .claims )
166- if tt .hasKeyId {
167- token .Header ["kid" ] = tn .keyId
206+ if tt .invalidKey {
207+ if tt .hasKeyId {
208+ token .Header ["kid" ] = tn .keyId
209+ }
210+ tokenString , err = token .SignedString (tn .invalidKey )
211+ } else {
212+ if tt .hasKeyId {
213+ token .Header ["kid" ] = tn .keyId
214+ }
215+ tokenString , err = token .SignedString (tn .privateKey )
168216 }
169- tokenString , err := token .SignedString (tn .privateKey )
170217 assert .NoError (t , err )
171218
172219 manager := NewJwksKeyManager (tn .jwksUrl , & ValidatableMapClaims {"aud" : "test-svc" })
0 commit comments