honeymoose/jjwt
1
0
Fork 0
mirror of https://github.com/jwtk/jjwt.git synced 2025-03-09 06:46:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from aarondav/patch-2

Browse Source 
Avoid potentially critical vulnerability in ECDSA signature validation
This commit is contained in:
Les Hazlewood 2016-07-04 11:56:48 -07:00 committed by GitHub
commit e55ea34e95
1 changed files with 2 additions and 2 deletions

4
src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java

@ -319,8 +319,8 @@ public class DefaultJwtParser implements JwtParser {
if (!Objects.isEmpty(keyBytes)) { if (!Objects.isEmpty(keyBytes)) {
Assert.isTrue(!algorithm.isRsa(), Assert.isTrue(algorithm.isHmac(),
"Key bytes cannot be specified for RSA signatures. Please specify a PublicKey or PrivateKey instance."); "Key bytes can only be specified for HMAC signatures. Please specify a PublicKey or PrivateKey instance.");
key = new SecretKeySpec(keyBytes, algorithm.getJcaName()); key = new SecretKeySpec(keyBytes, algorithm.getJcaName());
} }