GoogleCloudPlatform / GoogleCloudPlatform/getting-started-python

Replace python-jose dependency

Abierto
#565 2 comentarios 1 reacción 0 asignados Ver en GitHub
priority: p1 type: cleanup
Lenguaje dominante
Python
Estrellas
819
Forks
571
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

A vulnerability has been found in the `ecdsa` dependency which will not be patched in the `python-jose` package. `python-jose` [seems to be abandoned](https://github.com/mpdavis/python-jose/issues/332). Other people are also encountering these [security issues](https://github.com/mpdavis/python-jose/issues/341).

I suggest to update [authenticating-users/main.py](https://github.com/GoogleCloudPlatform/getting-started-python/blob/main/authenticating-users/main.py) to not use this insecure package. A commonly used alternative is PyJWT.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.