eclipse-ee4j / eclipse-ee4j/soteria

NPE when calling jwtClaimsSet.getClaims()

Open
#335 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
72
Forks
34
PR merge metrics
No merged PRs in 30d

Description

When trying to get auth0, I clone this project and add some debug info the following piece in the https://github.com/eclipse-ee4j/soteria/blob/master/impl/src/main/java/org/glassfish/soteria/mechanisms/openid/domain/AccessTokenImpl.java#L63, the `jwtClaimsSet.getClaims()`is possible when tokenJWT is a EncryptedJWT.

```java
try {
this.tokenJWT = JWTParser.parse(token);
jwtClaimsSet = tokenJWT.getJWTClaimsSet();
this.claims = jwtClaimsSet.getClaims();
} catch (ParseException ex) {
// Access token doesn't need to be JWT at all
}
```

Contributor guide

Open the contributing guide

Research direction

Start in impl/src/main/java/org/glassfish/soteria/mechanisms/openid/domain/AccessTokenImpl.java around line 63 and inspect how JWTParser.parse handles an EncryptedJWT. Reproduce the access-token path described in the issue and trace the null value before deciding on the appropriate handling. Done means encrypted-token processing no longer causes the reported NullPointerException.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.