Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def validate_iat(self, now, leeway):
"""The "iat" (issued at) claim identifies the time at which the JWT was
issued. This claim can be used to determine the age of the JWT. Its
value MUST be a number containing a NumericDate value. Use of this
claim is OPTIONAL.
"""
iat = self.get('iat')
if iat and not isinstance(iat, int):
raise InvalidClaimError('iat')
def _validate_claim_value(self, claim_name):
option = self.options.get(claim_name)
value = self.get(claim_name)
if not option or not value:
return
option_value = option.get('value')
if option_value and value != option_value:
raise InvalidClaimError(claim_name)
option_values = option.get('values')
if option_values and value not in option_values:
raise InvalidClaimError(claim_name)
validate = option.get('validate')
if validate and not validate(self, value):
raise InvalidClaimError(claim_name)
def validate_exp(self, now, leeway):
"""The "exp" (expiration time) claim identifies the expiration time on
or after which the JWT MUST NOT be accepted for processing. The
processing of the "exp" claim requires that the current date/time
MUST be before the expiration date/time listed in the "exp" claim.
Implementers MAY provide for some small leeway, usually no more than
a few minutes, to account for clock skew. Its value MUST be a number
containing a NumericDate value. Use of this claim is OPTIONAL.
"""
exp = self.get('exp')
if exp:
if not isinstance(exp, int):
raise InvalidClaimError('exp')
if exp < (now - leeway):
raise ExpiredTokenError()
def validate_amr(self):
"""OPTIONAL. Authentication Methods References. JSON array of strings
that are identifiers for authentication methods used in the
authentication. For instance, values might indicate that both password
and OTP authentication methods were used. The definition of particular
values to be used in the amr Claim is beyond the scope of this
specification. Parties using this claim will need to agree upon the
meanings of the values used, which may be context-specific. The amr
value is an array of case sensitive strings.
"""
amr = self.get('amr')
if amr and not isinstance(self['amr'], list):
raise InvalidClaimError('amr')
of the code value, where the hash algorithm used is the hash algorithm
used in the alg Header Parameter of the ID Token's JOSE Header. For
instance, if the alg is HS512, hash the code value with SHA-512, then
take the left-most 256 bits and base64url encode them. The c_hash
value is a case sensitive string.
If the ID Token is issued from the Authorization Endpoint with a code,
which is the case for the response_type values code id_token and code
id_token token, this is REQUIRED; otherwise, its inclusion is OPTIONAL.
"""
code = self.params.get('code')
c_hash = self.get('c_hash')
if code:
if not c_hash:
raise MissingClaimError('c_hash')
if not _verify_hash(c_hash, code, self.header['alg']):
raise InvalidClaimError('c_hash')
def validate_nbf(self, now, leeway):
"""The "nbf" (not before) claim identifies the time before which the JWT
MUST NOT be accepted for processing. The processing of the "nbf"
claim requires that the current date/time MUST be after or equal to
the not-before date/time listed in the "nbf" claim. Implementers MAY
provide for some small leeway, usually no more than a few minutes, to
account for clock skew. Its value MUST be a number containing a
NumericDate value. Use of this claim is OPTIONAL.
"""
nbf = self.get('nbf')
if nbf:
if not isinstance(nbf, int):
raise InvalidClaimError('nbf')
if nbf > (now + leeway):
raise InvalidTokenError()
def _validate_uri(self, key, uri=None):
if uri is None:
uri = self.get(key)
if uri and not is_valid_url(uri):
raise InvalidClaimError(key)
aud_values = aud_option.get('values')
if not aud_values:
aud_value = aud_option.get('value')
if aud_value:
aud_values = [aud_value]
if not aud_values:
return
if isinstance(self['aud'], list):
aud_list = self['aud']
else:
aud_list = [self['aud']]
if not any([v in aud_list for v in aud_values]):
raise InvalidClaimError('aud')