python-jose

python-jose copied to clipboard

Limit token size to 250 KB

1

princekhunt

Algorithm confusion with OpenSSH ECDSA keys and other key formats

2

## Issue description If the `algorithm` field is left unspecified when calling `jwt.decode`, the library will allow HS256 verification with OpenSSH ECDSA public keys, and similar key formats. PyJWT had...

milliesolem

After upgrading ecdsa to 0.19.0 we are seeing failing tests on python-jose 3.3.0. ``` FAILED tests/algorithms/test_EC_compat.py::TestBackendEcdsaCompatibility::test_public_key_to_pem[ECDSAECKey-CryptographyECKey] - AssertionError: assert b'-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKo... FAILED tests/algorithms/test_EC_compat.py::TestBackendEcdsaCompatibility::test_public_key_to_pem[CryptographyECKey-ECDSAECKey] - AssertionError: assert b'-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKo......

mweinelt

is there any function or approach to implement refresh token?

KianSabzi

Python 3.12 deprecates `datetime.utcnow()` in favor of using timezone-aware objects like `datetime.now(UTC)`. This commit updates the codebase accordingly to align with the latest recommendations. https://docs.python.org/3/library/datetime.html#datetime.datetime.utcnow

iamdhakrey

I believe this GitHub repo has been effectively abandoned in favor of https://authlib.org/. I would recommend everyone migrate their projects to use Authlib directly. As such, I would recommend the...

twwildey

Fix for CVE-2024-33664. JWE limited to 250K

9

This fix for CVE-2024-33664 ensures that any incoming JWE is under 250K, which seems to be a sensible, albeit large limit. The specific fix for the "zip bomb" issue ensures...

alistairwatts

Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.3 to 42.0.4. Changelog Sourced from cryptography's changelog. 42.0.4 - 2024-02-20 * Fixed a null-pointer-dereference and segfault that could occur when creating a PKCS#12 bundle. Credit to...

dependabot[bot]

If `iat` is provided, but the value is `null` (or `None` once deserialized), a `TypeError` is raised instead of a `JWTClaimsError`. I think the following piece of code should handle...

Colin-b

https://github.com/mpdavis/python-jose/blob/58e543ea5ea225961e43e9cc2781165748478a0f/jose/utils.py#L13 Deprecation warning : ecdsa.py:276: DeprecationWarning: Function is unused in library code. If you use this code, change to util.string_to_number.

nmoreaud