Diplomarbeit-Absolventenverein/oqtane.framework
10
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

fix #3556 - pad token secret to 32 characters to resolve IDX1-720, change id of "secret" input to reduce chance of form autocomplete causing issues

Browse Source
This commit is contained in:
sbwalker
2023-12-18 09:51:18 -05:00
parent 7c206af757
commit c5d4e237ad
3 changed files with 37 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Oqtane.Server/Security/JwtManager.cs
View File

@ -17,6 +17,9 @@ namespace Oqtane.Security
{
public string GenerateToken(Alias alias, ClaimsIdentity identity, string secret, string issuer, string audience, int lifetime)
{
// ensure secret is 256 bits
if (secret.Length < 32) secret = (secret + "????????????????????????????????").Substring(0, 32);
var tokenHandler = new JwtSecurityTokenHandler();
var key = Encoding.ASCII.GetBytes(secret);
var tokenDescriptor = new SecurityTokenDescriptor
@ -35,6 +38,9 @@ namespace Oqtane.Security
{
if (!string.IsNullOrEmpty(token))
{
// ensure secret is 256 bits
if (secret.Length < 32) secret = (secret + "????????????????????????????????").Substring(0, 32);
var tokenHandler = new JwtSecurityTokenHandler();
var key = Encoding.ASCII.GetBytes(secret);
try