alloy-rs / alloy-rs/alloy

[Bug] AuthLayer produces JWT with "exp" claim set to null

Abierto
#4,031 0 comentarios 0 reacciones 0 asignados Ver en GitHub
bug
Lenguaje dominante
Rust
Estrellas
1.3k
Forks
668
Merge medio
2 d 2 h
PR fusionados (30 d)
29

Descripción

### Component

transports

### What version of Alloy are you on?

2.0.5

### Operating System

None

### Describe the bug

AuthLayer inserts Authorization header with a JWT that is rejected as invalid by some execution clients (Besu). The reason is that the claim set in this JWT is serialized as `{"iat": , "exp": null}`: that is, instead of omitting `exp` claim, it is specified with `null` value.
Per RFC7519, §4.1.4, the value of `exp` claim must be a number.

Suggestion: set up serialization of `Claims` so that when `exp` has `None` value, it is omitted from the serialized representation.

Note also that Engine API specification does not specify the use of `exp`, it only uses `iat` for staleness detection; not sure why `exp` is included into the JWT used to authenticate Engine API.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.