h

h copied to clipboard

https://sentry.io/organizations/hypothesis/issues/1106040600/

A crash occurs if a publisher with keys for an authority generates a grant token for an invalid user ID (eg. acct:@authority) and the client POSTs it to the /api/token route.

In one of the reports in the linked Sentry issue, the contents of the JWT token submitted to the endpoint was:

{
  "aud": "hypothes.is",
  "iss": "d9bb38d6-9c38-11e9-9718-935e4c0dc38c",
  "sub": "acct:@h.jonudell.info",
  "nbf": 1563383764,
  "exp": 1563384364
}

FYI @judell

Sentry issue: H-1QA