awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 05:27:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix KID match

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-07 09:20:15 -08:00
parent 4d9833acd6
commit 5256b11402
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/pki-acme/pki-acme-service.ts
+7 -6
View File
@@ -339,10 +339,15 @@ export const pkiAcmeServiceFactory = ({
externalAccountBinding, externalAccountBinding,
eabSecret eabSecret
); );
const eabAlg = eabProtectedHeader!.alg!; const { alg: eabAlg, kid: eabKid } = eabProtectedHeader!;
if (!["HS256", "HS384", "HS512"].includes(eabAlg)) { if (!["HS256", "HS384", "HS512"].includes(eabAlg!)) {
throw new AcmeMalformedError({ detail: "Invalid algorithm for external account binding JWS payload" }); throw new AcmeMalformedError({ detail: "Invalid algorithm for external account binding JWS payload" });
} }
// Make sure the KID in the EAB payload matches the profile ID
if (eabKid !== profile.id) {
throw new UnauthorizedError({ message: "External account binding KID mismatch" });
}
// Make sure the URL matches the expected URL // Make sure the URL matches the expected URL
const url = eabProtectedHeader!.url!; const url = eabProtectedHeader!.url!;
if (url !== buildUrl(profile.id, "/new-account")) { if (url !== buildUrl(profile.id, "/new-account")) {
@@ -359,10 +364,6 @@ export const pkiAcmeServiceFactory = ({
message: "External account binding public key thumbprint or algorithm mismatch" message: "External account binding public key thumbprint or algorithm mismatch"
}); });
} }
// Make sure the KID in the EAB payload matches the profile ID
if ((eabPayload as unknown as { kid: string }).kid !== profile.id) {
throw new UnauthorizedError({ message: "External account binding KID mismatch" });
}
} catch (error) { } catch (error) {
if (error instanceof errors.JWSInvalid) { if (error instanceof errors.JWSInvalid) {
throw new AcmeMalformedError({ detail: "Invalid external account binding JWS payload" }); throw new AcmeMalformedError({ detail: "Invalid external account binding JWS payload" });