wps_forward_bot
🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 The JWT blocklist is silently bypassed by tokens without a `jti` (#1322)
There are two problem with jti and blocklist app:
1. We ignore cases where jti is None in the payload. None can't be found here: self.blocklist_model().objects.filter(jti=token.jti).exists(), so this check always passes. Moreover, it does not make sence to use tokens without jti and blocklist app
2. We don't check that token is created with a valid jti when blocklist app is used. We must do that, so this won't potentially fail on tokens with jti=None:
django-modern-rest/dmr/security/jwt/blocklist/auth.py
Lines 59 to 70 in a2d44b1
So, the logout path raises IntegrityError (HTTP 500) rather than a clean error.
We need to add ['jti'] to self.require_claims with JWTokenBlocklistSyncMixin and JWTokenBlocklistAsyncMixin.
(please, do not take this issue before the 1st of September)
#bug #good_first_issue #help_wanted #security #opensource_september #django_modern_rest
sent via relator
2 · 182 ·