Skip to content

Commit e856aa1

Browse files
claudiamurialdoclaudiamurialdo
andcommitted
Handle large string values with SHA256 in JWT tokens (#1237)
https://github.com/genexuslabs/DotNetClasses/pull/1157/files Co-authored-by: claudiamurialdo <c.murialdo@globant.com> (cherry picked from commit c42cfa2)
1 parent 7979dc9 commit e856aa1

2 files changed

Lines changed: 21 additions & 11 deletions

File tree

dotnet/src/dotnetframework/GxClasses/Middleware/GXHttp.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1794,7 +1794,7 @@ protected string GetSecureSignedToken(String cmpCtx, GxUserType Value, IGxContex
17941794

17951795
protected string GetSecureSignedToken(string cmpCtx, string value, IGxContext context)
17961796
{
1797-
return WebSecurityHelper.Sign(PgmInstanceId(cmpCtx), string.Empty, value, SecureTokenHelper.SecurityMode.Sign, context);
1797+
return GetSecureSignedHashedToken(cmpCtx, SecureTokenHelper.GetTokenValue(value), context);
17981798
}
17991799
private string GetSecureSignedHashedToken(string cmpCtx, TokenValue tokenValue, IGxContext context)
18001800
{

dotnet/src/dotnetframework/GxClasses/Security/WebSecurity.cs

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,17 @@ private static string GetSecretKey(IGxContext context)
5555
}
5656

5757
public static bool Verify(string pgmName, string issuer, string value, string jwtToken, IGxContext context)
58-
{
59-
WebSecureToken token;
60-
return WebSecurityHelper.Verify(pgmName, issuer, value, jwtToken, out token, context);
58+
{
59+
WebSecureToken token;
60+
WebSecureToken jwtTokenObj = SecureTokenHelper.getWebSecureToken(jwtToken, GetSecretKey(context));
61+
if (jwtTokenObj != null && jwtTokenObj.ValueType == ValueTypeHash)
62+
{
63+
return Verify(pgmName, issuer, GetHash(value), jwtToken, out token, context);
64+
}
65+
else
66+
{
67+
return Verify(pgmName, issuer, value, jwtToken, out token, context);
68+
}
6169
}
6270
public static bool Verify(string pgmName, string issuer, string value, string jwtToken, out WebSecureToken token, IGxContext context)
6371
{
@@ -251,20 +259,22 @@ internal static bool Verify(string jwtToken, WebSecureToken outToken, string sec
251259
}
252260
internal static TokenValue GetTokenValue(IGxJSONSerializable obj)
253261
{
254-
255-
string jsonString = obj.ToJSonString();
262+
return GetTokenValue(obj.ToJSonString());
263+
}
264+
internal static TokenValue GetTokenValue(string value)
265+
{
256266

257-
if (jsonString.Length > MaxTokenValueLength)
267+
if (value!=null && value.Length > MaxTokenValueLength)
258268
{
259-
string hash = GetHash(jsonString);
269+
string hash = GetHash(value);
260270
GXLogging.Debug(_log, $"GetTokenValue: TokenValue is too long, using hash: {hash} instead of original value.");
261-
GXLogging.Debug(_log, $"Server TokenOriginalValue:" + jsonString);
271+
GXLogging.Debug(_log, $"Server TokenOriginalValue:" + value);
262272
return new TokenValue() { Value = hash, ValueType = ValueTypeHash };
263273
}
264274
else
265275
{
266-
GXLogging.Debug(_log, $"GetTokenValue:" + jsonString);
267-
return new TokenValue() { Value = jsonString };
276+
GXLogging.Debug(_log, $"GetTokenValue:" + value);
277+
return new TokenValue() { Value = value };
268278
}
269279
}
270280
internal static string GetHash(string jsonString)

0 commit comments

Comments
 (0)