8000 Handling jwt decoding errors correctly · ZachOrr/firebase-admin-python@dd56417 · GitHub
[go: up one dir, main page]
Skip to content

Commit dd56417

Browse files
hiranya911hiranya911
committed
Handling jwt decoding errors correctly
1 parent ec894a9 commit dd56417

File tree

3 files changed

+21
-4
lines changed

3 files changed

+21
-4
lines changed

‎firebase_admin/_token_gen.py

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,8 +270,7 @@ def verify(self, token, request):
270270
'or set your Firebase project ID as an app option. Alternatively set the '
271271
'GOOGLE_CLOUD_PROJECT environment variable.'.format(self.operation))
272272

273-
header = jwt.decode_header(token)
274-
payload = jwt.decode(token, verify=False)
273+
header, payload = self._decode_token(token)
275274
issuer = payload.get('iss')
276275
audience = payload.get('aud')
277276
subject = payload.get('sub')
@@ -347,3 +346,15 @@ def verify(self, token, request):
347346
'Invalid Firebase {0}: {1}'.format(self.short_name, error),
348347
cause=error,
349348
auth_error_code=self.error_code)
349+
350+
def _decode_token(self, token):
351+
try:
352+
header = jwt.decode_header(token)
353+
payload = jwt.decode(token, verify=False)
354+
return header, payload
355+
except ValueError as error:
356+
raise _auth_utils.FirebaseAuthError(
357+
exceptions.INVALID_ARGUMENT,
358+
'Invalid Firebase {0}: {1}'.format(self.short_name, error),
359+
cause=error,
360+
auth_error_code=self.error_code)

‎firebase_admin/auth.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,12 @@
7575
'verify_id_token',
7676
'verify_session_cookie',
7777

78+
'CERTIFICATE_FETCH_FAILED',
7879
'ID_TOKEN_REVOKED',
80+
'INVALID_ID_TOKEN',
81+
'INVALID_SESSION_COOKIE',
7982
'SESSION_COOKIE_REVOKED',
83+
'TOKEN_SIGN_FAILED',
8084
'UNEXPECTED_RESPONSE',
8185
'USER_NOT_FOUND',
8286
]

‎tests/test_token_gen.py

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,7 @@ class TestVerifyIdToken(object):
341341
'iat': int(time.time()) - 10000,
342342
'exp': int(time.time()) - 3600
343343
}),
344+
'MalformedToken': 'foobar',
344345
}
345346

346347
@pytest.mark.parametrize('id_token', valid_tokens.values(), ids=list(valid_tokens))
@@ -382,7 +383,7 @@ def test_revoked_token_do_not_check_revoked(self, user_mgt_app, revoked_tokens,
382383
assert claims['admin'] is True
383384
assert claims['uid'] == claims['sub']
384385

385-
@pytest.mark.parametrize('id_token', [None, '', 'foobar', True, 1, [], {}, {'a': 1}])
386+
@pytest.mark.parametrize('id_token', [None, '', True, 1, [], {}, {'a': 1}])
386387
def test_invalid_jwt(self, user_mgt_app, id_token):
387388
_overwrite_cert_request(user_mgt_app, MOCK_REQUEST)
388389
with pytest.raises(ValueError):
@@ -455,6 +456,7 @@ class TestVerifySessionCookie(object):
455456
'exp': int(time.time()) - 3600
456457
}),
457458
'IDToken': TEST_ID_TOKEN,
459+
'MalformedToken': 'foobar',
458460
}
459461

460462
@pytest.mark.parametrize('cookie', valid_cookies.values(), ids=list(valid_cookies))
@@ -490,7 +492,7 @@ def test_revoked_cookie_does_not_check_revoked(self, user_mgt_app, revoked_token
490492
assert claims['admin'] is True
491493
assert claims['uid'] == claims['sub']
492494

493-
@pytest.mark.parametrize('cookie', [None, '', 'foobar', True, 1, [], {}, {'a': 1}])
495+
@pytest.mark.parametrize('cookie', [None, '', True, 1, [], {}, {'a': 1}])
494496
def test_invalid_jwt(self, user_mgt_app, cookie):
495497
_overwrite_cert_request(user_mgt_app, MOCK_REQUEST)
496498
with pytest.raises(ValueError):

0 commit comments

Comments
 (0)
0