tkmind/tkmind_go
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

fix(oidc-proxy): enforce exp independently of MAX_TOKEN_AGE_SECONDS (#8832) (#8839)

Browse Source 
Signed-off-by: jeffhuang <jeffwalt630@gmail.com>
Signed-off-by: Douwe Osinga <douwe@squareup.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Douwe Osinga <douwe@squareup.com>
This commit is contained in:
parasol-aser
2026-05-12 18:41:10 -05:00
committed by GitHub
parent 80cac3626f
commit 66c89db942
3 changed files with 67 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oidc-proxy/src/index.js
+4 -5
View File
@@ -190,17 +190,16 @@ async function verifyOidcToken(token, env) {
const header = decodeJwtPart(headerB64);
const payload = decodeJwtPart(payloadB64);
if (!payload.exp || payload.exp < Date.now() / 1000) {
return { valid: false, reason: "Token expired" };
}
if (env.MAX_TOKEN_AGE_SECONDS && payload.iat) {
const age = Date.now() / 1000 - payload.iat;
const age = Math.floor(Date.now() / 1000) - payload.iat;
if (age > parseInt(env.MAX_TOKEN_AGE_SECONDS, 10)) {
return { valid: false, reason: "Token too old" };
}
}
if (!payload.exp || payload.exp < Date.now() / 1000) {
return { valid: false, reason: "Token expired" };
}
const expectedIssuer = env.OIDC_ISSUER.replace(/\/$/, "");
const actualIssuer = (payload.iss || "").replace(/\/$/, "");
if (actualIssuer !== expectedIssuer) {