fix #2072: Prevent JWT validation failure as an API key when the audi…

…ence is null
MAIF · Jan 10, 2025 · 990d0c8 · 990d0c8
1 parent e75b82b
commit 990d0c8
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/otoroshi/app/models/apikey.scala b/otoroshi/app/models/apikey.scala
@@ -1930,9 +1930,9 @@ object ApiKeyHelper {
                         .build
                     Try(verifier.verify(jwt))
                       .filter { token =>
-                        val aud = token.getAudience.asScala.headOption.filter(v =>
+                        val aud = Option(token.getAudience).flatMap(_.asScala.headOption.filter(v =>
                           v.startsWith("http://") || v.startsWith("https://")
-                        )
+                        ))
                         if (aud.isDefined) {
                           val currentUrl = req.theUrl
                           val audience   = aud.get

diff --git a/otoroshi/test/Suites.scala b/otoroshi/test/Suites.scala
@@ -183,3 +183,8 @@ class GreenScoreTest
     extends Suites(
       new GreenScoreTestSpec("GreenScore", Configurations.InMemoryConfiguration)
     )
+
+//class ApiKeysTest
+//    extends Suites(
+//      new ApiKeysSpec("ApiKeysSpec", Configurations.InMemoryConfiguration)
+//    )