sevensolutions#6: Fix token validation.

WhySoBad · Sep 28, 2024 · 0b16846 · 0b16846
1 parent 8dad1d5
commit 0b16846
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/oidc.go b/oidc.go
@@ -225,25 +225,25 @@ func validateToken(oidcAuth *TraefikOidcAuth, tokenString string) (bool, *jwt.Ma
 		return false, nil, err
 	}
 
-	parser := jwt.NewParser()
+	parser := jwt.NewParser(
+		jwt.WithIssuer(oidcAuth.Config.Provider.Url),
+		jwt.WithExpirationRequired(),
+	)
 
-	_, err = parser.ParseWithClaims(tokenString, &claims, oidcAuth.Jwks.Keyfunc)
+	_, err = parser.ParseWithClaims(tokenString, claims, oidcAuth.Jwks.Keyfunc)
 
 	if err != nil {
 		err := oidcAuth.Jwks.EnsureLoaded(oidcAuth, true)
 		if err != nil {
 			return false, nil, err
 		}
 
-		_, err = parser.ParseWithClaims(tokenString, &claims, oidcAuth.Jwks.Keyfunc)
+		_, err = parser.ParseWithClaims(tokenString, claims, oidcAuth.Jwks.Keyfunc)
 
 		if err != nil {
 			return false, nil, err
 		}
 	}
 
-	// TODO: Remove this. I don't know why, but ParseWithClaims() isn't returning claims
-	_, _, err = parser.ParseUnverified(tokenString, claims)
-
 	return true, &claims, nil
 }