Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

proxy/request signers: request signers should also sign access token #179

Merged
merged 1 commit into from
Apr 17, 2019
Merged

proxy/request signers: request signers should also sign access token #179

merged 1 commit into from
Apr 17, 2019

Conversation

jphines
Copy link
Contributor

@jphines jphines commented Apr 17, 2019

Problem

We received a security report that request signatures do not sign access tokens if the proxy is configured to forward them. These access tokens should be signed by our various signature methods so upstreams can be ensured that these tokens have not tampered via a MITM attack.

@jphines jphines added bug Something isn't working security/low-sev labels Apr 17, 2019
@jphines jphines self-assigned this Apr 17, 2019
@jphines jphines merged commit 3f8de31 into master Apr 17, 2019
@jphines jphines deleted the proxy-request-signatures-should-include-token branch April 17, 2019 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shrayolacrayon shrayolacrayon shrayolacrayon approved these changes

Assignees

@jphines jphines

Labels
bug Something isn't working security/low-sev
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jphines @shrayolacrayon