Options hash uses both symbols and strings as keys. about ruby-jwt HOT 6 CLOSED

👍 for symbol only until someone complain about it 😄

from ruby-jwt.

👍 symbols only :)

from ruby-jwt.

+1

This is an issue beyond semantics... @aj-michael it is a security hole.

I pass in the following:
{:aud=>"test_aud_id", :verify_aud=>true}

and it decodes the token successfully. The hole is it decodes regardless of what the aud is. You can see this bug in line jwt.rb#172 if options[:verify_aud] && options['aud']

if I pass in:
{:aud=>"test_aud_id", :verify_aud=>true, :verify_iat=>true, :sub=>"test_sub_id", :verify_sub=>true}

this fails because how the verify_sub checks, it doesn't allow it to silently fail (even though sub is set in the token)

from ruby-jwt.

@aj-michael @yordis @skippy :)

from ruby-jwt.

@excpt fair enough! I wasn't trying to be snarky. Thank you for the fast PR!

from ruby-jwt.

@excpt awesome, very good clean there 👍

from ruby-jwt.