Skip to content

Authenticated Push: must also verify the iss claim #2111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Apr 12, 2019
Merged

Authenticated Push: must also verify the iss claim #2111

merged 3 commits into from
Apr 12, 2019

Conversation

anguillanneuf
Copy link
Member

@anguillanneuf anguillanneuf commented Apr 12, 2019 •
edited
Loading

The Google Auth Python library's verify_oauth2_token() function doesn't verify the iss claim. The same function in Node.js/Java/PHP does. (More detail: https://developers.google.com/identity/sign-in/web/backend-auth)

@googlebot googlebot added the cla: yes This human has signed the Contributor License Agreement. label Apr 12, 2019
@anguillanneuf anguillanneuf requested review from engelke and lesv April 12, 2019 19:18
engelke
engelke approved these changes Apr 12, 2019
View reviewed changes
Copy link
Contributor

@engelke engelke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@anguillanneuf anguillanneuf merged commit 964b898 into master Apr 12, 2019
@anguillanneuf anguillanneuf deleted the authenticated_push branch April 12, 2019 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@engelke engelke engelke approved these changes

@lesv lesv lesv approved these changes

Assignees
No one assigned
Labels
cla: yes This human has signed the Contributor License Agreement.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@anguillanneuf @engelke @lesv @googlebot