Skip to content

fix: validate JWT exp claim in Go services using ParseWithClaims - #10

Merged
Senthil455 merged 22 commits into
mainfrom
fix/jwt-exp-validation
Jun 15, 2026
Merged

fix: validate JWT exp claim in Go services using ParseWithClaims#10
Senthil455 merged 22 commits into
mainfrom
fix/jwt-exp-validation

Conversation

@Senthil455

Copy link
Copy Markdown
Owner

Changes

Fixed JWT expiration validation across three Go services where jwt.Parse with MapClaims silently discarded type-assertion errors and did not automatically validate the exp claim, allowing tokens to remain valid forever.

Files changed:

  • services/attendance-service/auth.go — Replaced jwt.Parse with jwt.ParseWithClaims using a typed internalClaims struct embedding jwt.RegisteredClaims. Removed silent _ type-assertion discards.
  • services/lms-service/middleware/auth.go — Same fix as attendance-service.
  • services/notification-go-service/main.go — Same fix for both validateJWT and internalAuthMiddleware functions.

What changed:

  • Added custom claims structs embedding jwt.RegisteredClaims (enables automatic exp, nbf, iat validation)
  • Switched from jwt.Parse to jwt.ParseWithClaims for typed claim parsing
  • Replaced claims["key"].(string) silent discards with typed field access
  • Removed redundant !token.Valid checks (handled by ParseWithClaims with RegisteredClaims)

Senthil455 and others added 22 commits May 26, 2026 00:21
…pdate

feat: update header section UI with sticky scroll shadow, user dropdo…
Most services rely solely on X-Tenant-Id and X-User-Role HTTP headers from the client with zero verification. Any client can impersonate any tenant or role. The attendance service (Go/Fiber) has no middleware at all — all endpoints are fully public.

Files:

services/attendance-service/main.go:249 — No auth middleware
services/payroll-java-service/.../PayrollController.java:40-41 — Client controls X-User-Role: admin
services/live-service/main.py — All endpoints public
services/lms-service/handlers/*.go — No auth checks

Co-Authored-By: Divya shree R <divyashreer2538@gmail.com>
…auth bypass

Security Fix

The SAML ACS endpoint (POST /saml/acs) previously decoded the base64
SAMLResponse and extracted user attributes via regex without verifying
the XML digital signature. This allowed anyone with a crafted SAMLResponse
to impersonate any user.

Changes:
- Added @xmldom/xmldom and xml-crypto dependencies
- Added SAML_IDP_CERT environment variable for IdP public certificate
- Parse SAML XML and verify ds:Signature before processing assertions
- If SAML_IDP_CERT is configured, reject unsigned or invalid signatures
- Signature verification uses X.509 certificate from environment config
- Backward compatible: if SAML_IDP_CERT is empty, no verification is
  performed (dev mode); log a warning in this case
…fication

fix: add SAML response XML digital signature verification to prevent …
@Senthil455
Senthil455 merged commit b9a6977 into main Jun 15, 2026
1 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants