proxy/request signers: request signers should also sign access token by jphines · Pull Request #179

proxy/request signers: request signers should also sign access token by jphines · Pull Request #179 · buzzfeed/sso

buzzfeed / sso Public

Notifications You must be signed in to change notification settings
Fork 189
Star 3.1k

Merged

jphines merged 1 commit intomasterfrom

proxy-request-signatures-should-include-token

Apr 17, 2019

Merged

proxy/request signers: request signers should also sign access token#179
jphines merged 1 commit intomasterfrom
proxy-request-signatures-should-include-token

Conversation

Copy link

Contributor

jphines commented
Apr 17, 2019

Problem

We received a security report that request signatures do not sign access tokens if the proxy is configured to forward them. These access tokens should be signed by our various signature methods so upstreams can be ensured that these tokens have not tampered via a MITM attack.