dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve token handling

Browse Source
This commit is contained in:
Nanne Baars 2021-03-14 16:45:17 +01:00 committed by Nanne Baars
parent 59e04dee6e
commit e40a26f193
2 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
webwolf/src/main/java/org/owasp/webwolf/jwt/JWTToken.java
View File

@ -30,8 +30,6 @@ import static org.springframework.util.StringUtils.hasText;
@Builder(toBuilder = true) @Builder(toBuilder = true)
public class JWTToken { public class JWTToken {
private static final Pattern jwtPattern = Pattern.compile("(.*)\\.(.*)\\.(.*)");
private String encoded = ""; private String encoded = "";
private String secretKey; private String secretKey;
private String header; private String header;
@ -100,12 +98,12 @@ public class JWTToken {
} }
private static JWTToken parseToken(String jwt) { private static JWTToken parseToken(String jwt) {
var matcher = jwtPattern.matcher(jwt); var token = jwt.split("\\.");
var builder = JWTToken.builder().encoded(jwt); var builder = JWTToken.builder().encoded(jwt);
if (matcher.matches()) { if (token.length >= 2) {
var header = new String(decodeFromUrlSafeString(matcher.group(1)), UTF_8); var header = new String(decodeFromUrlSafeString(token[0]), UTF_8);
var payloadAsString = new String(decodeFromUrlSafeString(matcher.group(2)), UTF_8); var payloadAsString = new String(decodeFromUrlSafeString(token[1]), UTF_8);
var headers = parse(header); var headers = parse(header);
var payload = parse(payloadAsString); var payload = parse(payloadAsString);
builder.header(write(header, headers)); builder.header(write(header, headers));

2
webwolf/src/main/resources/templates/jwt.html
View File

@ -54,7 +54,7 @@
<br/> <br/>
<div class="input-group"> <div class="input-group">
<span class="input-group-addon">Secret key</span> <span class="input-group-addon">Secret key</span>
<input type="text" value="webgoat" class="form-control" id="secretKey"> <input type="text" placeholder="Enter your secret key" class="form-control" id="secretKey">
</div> </div>
<div class="input-group"> <div class="input-group">