alloy-rs / alloy-rs/alloy

[Bug] AuthLayer produces JWT with "exp" claim set to null

Aperta
#4,031 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
bug
Lingua principale
Rust
Stelle
1.3k
Fork
668
Merge medio
2g 1h
PR unite (30g)
29

Descrizione

### Component

transports

### What version of Alloy are you on?

2.0.5

### Operating System

None

### Describe the bug

AuthLayer inserts Authorization header with a JWT that is rejected as invalid by some execution clients (Besu). The reason is that the claim set in this JWT is serialized as `{"iat": , "exp": null}`: that is, instead of omitting `exp` claim, it is specified with `null` value.
Per RFC7519, §4.1.4, the value of `exp` claim must be a number.

Suggestion: set up serialization of `Claims` so that when `exp` has `None` value, it is omitted from the serialized representation.

Note also that Engine API specification does not specify the use of `exp`, it only uses `iat` for staleness detection; not sure why `exp` is included into the JWT used to authenticate Engine API.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.