fix(rp): don't ignore JWKS parsing errors#771
Merged
wim07101993 merged 2 commits intozitadel:mainfrom Dec 3, 2025
Merged
Conversation
|
Hey @0xjac thank you for your contribution! We're a lil backed up with contributions atm but we'll have a look as soon as we can. |
13 tasks
This safely ignores unknown key type errors on JWKS while returning all other errors. Returned errors are wrap to easily identify which key in the set is problematic if any. Jose v4.0.3 was handling this correctly according to spec, but it was reverted in v4.0.4 as the implementation was a breaking change due to the custom UnmarshalJSON on the key set. For details see: - go-jose/go-jose#136 - go-jose/go-jose#137 Jose v4.0.4 also provided a handy static error to check for unknown web key types. Sadly this was removed: a prefix match on the error message is the best option until Jose improves it's error handling. Hopefully, Jose will not change the error message in a patch or minor version release. But just in case, test cases have been added to detect it. Closes zitadel#541
0xjac
force-pushed
the
fix/541-dont-ignore-jwks-errs
branch
from
d2630bc to
d2b458e
Compare
Contributor
Author
|
note: rebased onto main |
wim07101993
approved these changes
Dec 3, 2025
github-project-automation
bot
moved this from 📋 Sprint Backlog
to ✅ Done
in Product Management
|
🎉 This PR is included in version 3.45.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This safely ignores unknown key type errors on JWKS while returning all other errors. Returned errors are wrap to easily identify which key in the set is problematic if any.
Jose v4.0.3 was handling this correctly according to spec, but it was reverted in v4.0.4 as the implementation was a breaking change due to the custom UnmarshalJSON on the key set. For details see:
Jose v4.0.4 also provided a handy static error to check for unknown web key types. Sadly this was removed: a prefix match on the error message is the best option until Jose improves it's error handling.
Hopefully, Jose will not change the error message in a patch or minor version release. But just in case, test cases have been added to detect it.
Closes #541
Definition of Ready