Documentation
¶
Overview ¶
Package fositejose holds the go-jose v3 workarounds that fosite v0.49.0 needs. ToolHive uses go-jose v4, but fosite exposes go-jose v3 in its interfaces. The package has two parts.
The key conversions between go-jose v4 and v3 copy already-parsed keys field by field, so key material is never re-parsed by go-jose v3.
The embedded-JWK guard, IsUnsafeJWS, refuses JWS input with an embedded key before fosite parses it with go-jose v3. go-jose v3 is affected by GHSA-mgcc-cww5-fp2q and has no patched release.
Remove this package once fosite moves to go-jose v4.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FromFositeKeySet ¶
func FromFositeKeySet(jwks *josev3.JSONWebKeySet) *jose.JSONWebKeySet
FromFositeKeySet copies a key set read from a fosite client into the go-jose v4 type.
func IsUnsafeJWS ¶ added in v0.62.0
IsUnsafeJWS reports whether token must be refused before fosite parses it.
fosite v0.49.0 parses client assertions and OpenID Connect request objects with go-jose v3, which validates an RSA key embedded in a JWS header without bounding its size (GHSA-mgcc-cww5-fp2q; no patched v3 exists). An unauthenticated caller can use that to burn CPU before fosite looks up any client. fosite never uses an embedded key, since it resolves keys from the registered client, so refusing them does not affect conforming clients.
The check mirrors how go-jose v3's ParseSigned reads its input: whitespace is stripped, input starting with "{" is the JSON serialization (whose unprotected headers can also carry a key), and the compact form must have exactly three segments. Anything that cannot be decoded as a compact JWS header is reported unsafe, so a parsing difference fails closed. fosite rejects such input anyway.
Remove this once fosite moves to go-jose v4.1.6 or later.
func ToFositeKey ¶
func ToFositeKey(key *jose.JSONWebKey) *josev3.JSONWebKey
ToFositeKey copies key into the go-jose v3 type fosite expects.
func ToFositeKeySet ¶
func ToFositeKeySet(jwks *jose.JSONWebKeySet) *josev3.JSONWebKeySet
ToFositeKeySet copies jwks into the go-jose v3 type fosite expects.
Types ¶
This section is empty.
Source Files