kataras / kataras/iris

[BUG] Trailing comma in JWT's payload

Open
#2,517 2 comments 0 reactions 1 assignee Claimed by @kataras View on GitHub
🐞 type:bug 🤘 status:resolved
Dominant language
Go
Stars
25.6k
Forks
2.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
There's a syntax issue in the JWT token's payload: it contains a trailing comma. Here's how the decoded payload appears:

```json
{
"iat": 1736252478,
"exp": 1736252838,
"iss": "NAME",
"sub": "admin",
}
```

**Expected behavior**

Expected decoded payload:

```json
{
"iat": 1736252478,
"exp": 1736252838,
"iss": "NAME",
"sub": "admin"
}
```

**To Reproduce**

```go
type JWTService struct {
signer *jwt.Signer
verifier *jwt.Verifier
}

func newJWTService() *JWTService {
private, public := jwt.MustLoadRSA(config.PrivateKey, config.PublicKey)

return &JWTService{
signer: jwt.NewSigner(jwt.RS256, private, config.AccessTokenMaxAge),
verifier: jwt.NewVerifier(jwt.RS256, public),
}
}

func (s *JWTService) GenerateTokenPair(user model.User) (jwt.TokenPair, error) {
now := time.Now()

// Create refresh claims with user ID as subject
refreshClaims := jwt.Claims{
Subject: fmt.Sprintf("%s", user.Username),
Issuer: "NAME",
IssuedAt: now.Unix(),
Expiry: now.Add(time.Second * s.config.RefreshTokenMaxAge).Unix(),
}

// Create access claims with user details
accessClaims := jwt.Claims{
Subject: fmt.Sprintf("%s", user.Username),
Issuer: "NAME",
IssuedAt: now.Unix(),
Expiry: now.Add(time.Second * s.config.AccessTokenMaxAge).Unix(),
}

tokenPair, err := s.signer.NewTokenPair(accessClaims, refreshClaims, s.config.RefreshTokenMaxAge)
if err != nil {
return jwt.TokenPair{}, err
}

fmt.Printf("access token: %s\n", tokenPair.AccessToken)

return tokenPair, nil
}
```

**iris.Version**
- v12.2.11

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.