Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-86615

Pass algorithm parameter to token generation calls in oidc_vars.js

XMLWordPrintableJSON

    • Type: Icon: Task Task
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 8.0.0-rc0
    • Affects Version/s: None
    • Component/s: None
    • Labels:
      None
    • Server Security
    • Fully Compatible
    • Security 2024-02-19

      All tokens currently defined in oidc_vars.js are generated using the OIDCsignJWT function, which is always called in this module without the fourth "algorithm" parameter. This means that all test tokens are being signed using the "RS256" algorithm by default, even though the token is meant to be signed with a different digital signature algorithm.

            Assignee:
            erwin.pe@mongodb.com Erwin Pe
            Reporter:
            erwin.pe@mongodb.com Erwin Pe
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: