TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-11-28 05:37:34 +03:00
Code Issues Projects Releases Wiki Activity

Updated token verification to use dynamic audience check

Browse Source 
no issue

Admin key token verification was using hardcoded audience check with v2 admin endpoint, this updates it to check against api version and api type of the request url
This commit is contained in:
Rish 2019-08-09 19:43:41 +05:30 committed by Rishabh Garg
parent 7b761a8751
commit 6ce9a5fc0e
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
core/server/services/auth/api-key/admin.js
View File

@ -1,4 +1,5 @@
const jwt = require('jsonwebtoken');
const url = require('url');
const models = require('../../../models');
const common = require('../../../lib/common');
@ -90,10 +91,12 @@ const authenticate = (req, res, next) => {
// https://github.com/auth0/node-jsonwebtoken/issues/208#issuecomment-231861138
const secret = Buffer.from(apiKey.get('secret'), 'hex');
// @TODO When v3 api hits we should check against the api actually being used
// ensure the token was meant for this api
const {pathname} = url.parse(req.originalUrl);
const [hasMatch, version = 'v2', api = 'admin'] = pathname.match(/ghost\/api\/([^/]+)\/([^/]+)\/(.+)*/); // eslint-disable-line no-unused-vars
// ensure the token was meant for this api version
const options = Object.assign({
audience: '/v2/admin/'
audience: new RegExp(`\/?${version}\/${api}\/?$`) // eslint-disable-line no-useless-escape
}, JWT_OPTIONS);
try {