realloc/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Releases Packages Activity

[#2028] node: Check session token's NBF and IAT

Browse source 
ACL service did not check "Not Valid Before" and "Issued At" claims.

Signed-off-by: Pavel Karpy <carpawell@nspcc.ru>
This commit is contained in:
Pavel Karpy 2022-11-10 20:58:06 +03:00 • committed by fyrchik
parent aadd2ad050
commit 481b48b942
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
pkg/services/object/acl/v2/service.go
View file

@ -573,8 +573,8 @@ func (b Service) findRequestInfo(req MetaWithToken, idCnr cid.ID, op acl.Op) (in
if err != nil {
return info, errors.New("can't fetch current epoch")
}
if req.token.ExpiredAt(currentEpoch) {
return info, fmt.Errorf("%s: token has expired (current epoch: %d)",
if req.token.InvalidAt(currentEpoch) {
return info, fmt.Errorf("%s: token is invalid at %d epoch)",
invalidRequestMessage, currentEpoch)
}