Modernize JWT verification and crypto backend - #39
Merged
Conversation
quinnj
marked this pull request as ready for review
June 30, 2026 03:41
quinnj
force-pushed
the
codex/production-grade-jwt-verifier
branch
from
June 30, 2026 04:37
62878c7 to
68980d1
Compare
…eanup Security & correctness: - crypto: GC.@preserve the EVP_PKEY across the DigestSign/Verify Init/Update/Final sequence so a non-retained key cannot be finalized mid-operation (use-after-free). Rename sign_rsa/verify_rsa to evp_digest_sign/evp_digest_verify (they also serve EC/OKP via the shared EVP path). - verifier: verify() now raises typed JWTVerificationError/JWTClaimError instead of a bare ArgumentError on a malformed header/payload, matching the documented taxonomy. A missing expected iss/sub/jti/nonce/aud now reports :claim_missing, not :claim_type. - remote JWKS: require the OIDC discovery `issuer` field (no longer defaulted to the configured issuer), require an http(s) `jwks_uri`, and reject symmetric ("oct") keys arriving from a remote endpoint. - fetch_url: reject non-2xx HTTP responses (Downloads.request does not throw on them), so an error page can no longer be parsed into the keyset cache. - base64url_decode: strict base64url - reject +/ , mid-string '=', length % 4 == 1, and non-canonical trailing bits. The rsa/oct test JWKS fixtures are converted from standard base64 to base64url (identical decoded key bytes). - JWKSet: guard the resolve/refresh path with a lock for concurrently shared verifiers. - exp stays optional by default (unchanged); document that leeway widens max_age. Cleanup: - remove ACTION_ITEMS.md (internal agent roadmap with local paths). - drop dead urlenc/urldec/padb64 and the now-unused Base64 dependency. - README signing example uses string(jwt) (String(jwt) was a MethodError). Adds regression tests. Full suite (2657 tests) and the JuliaC --trim=safe compile pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verifier/VerifiedJWTAPI with explicit algorithm allowlists, registered claim validation, structured verifier errors, cached remote JWKS, and OIDC discovery.Security And Compatibility Notes
exp,nbf,iat,iss,aud,sub,jti,nonce, required claims, leeway, and max token age.validate!andwith_valid_jwtremain available as lower-level signature validation helpers, but application code should preferverify(::Verifier, ...).JWTtoken parts are read-only through the public API so validation state cannot be reused across key or policy changes.Validation
julia --project=. --startup-file=no -e 'using Pkg; Pkg.test()'passed locally with 2038 tests.git diff --checkpassed for each committed item.Co-authored by Codex