palantir / palantir/conjure-java
ConjureUndertowRuntime logs exceptions for non-Palantir JWTs
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 39
- Forks
- 49
- Avg merge
- 8h 22m
- Merged PRs (30d)
- 32
Description
What happened?
ConjureUndertowRuntime configures a ConjureAuthorizationExtractor which optimistically calls UnverifiedJsonWebToken.tryParse to extract user information from an unverified token.
However, the Palantir auth-tokens project assumes Palantir's JWT format. Specifically, it tries to decode sub, sid and jti as base64-encoded UUIDs: https://github.com/palantir/auth-tokens/blob/bb668c6e99dd211799cbc4aa7602114b9d882368/auth-tokens/src/main/java/com/palantir/tokens/auth/UnverifiedJsonWebToken.java#L125-L128
When using Conjure with non-Palantir tokens, this fills the logs with parse exceptions (albeit not failing the request).
What did you want to happen?
The ConjureUndertowRuntime.Builder could allow the user to override the mechanism for extracting the userId, sessionId and tokenId from a BearerToken.
Happy to put up a PR.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ConjureUndertowRuntime.Builder and trace its ConjureAuthorizationExtractor configuration, then inspect the referenced UnverifiedJsonWebToken.tryParse behavior in auth-tokens. Reproduce a request with a non-Palantir BearerToken and define done as configurable userId, sessionId, and tokenId extraction without parse-exception noise.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, backend-api-design
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100