Authlib 1.7.2__tar.gz → 1.9.0__tar.gz

{authlib-1.7.2 → authlib-1.9.0}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.7.2
+Version: 1.9.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -32,8 +32,8 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cryptography
-Requires-Dist: joserfc>=1.6.0
+Requires-Dist: cryptography>=45.0.1
+Requires-Dist: joserfc>=1.6.1
 Dynamic: license-file
 
 <div align="center">

{authlib-1.7.2 → authlib-1.9.0}/Authlib.egg-info/SOURCES.txt

@@ -54,6 +54,7 @@ authlib/integrations/flask_oauth2/requests.py
 authlib/integrations/flask_oauth2/resource_protector.py
 authlib/integrations/flask_oauth2/signals.py
 authlib/integrations/httpx_client/__init__.py
+authlib/integrations/httpx_client/_compat.py
 authlib/integrations/httpx_client/assertion_client.py
 authlib/integrations/httpx_client/oauth1_client.py
 authlib/integrations/httpx_client/oauth2_client.py
@@ -125,6 +126,8 @@ authlib/oauth2/auth.py
 authlib/oauth2/base.py
 authlib/oauth2/claims.py
 authlib/oauth2/client.py
+authlib/oauth2/drafts/__init__.py
+authlib/oauth2/drafts/id_jag.py
 authlib/oauth2/rfc6749/__init__.py
 authlib/oauth2/rfc6749/authenticate_client.py
 authlib/oauth2/rfc6749/authorization_server.py
@@ -199,6 +202,7 @@ authlib/oauth2/rfc9207/discovery.py
 authlib/oauth2/rfc9207/parameter.py
 authlib/oidc/__init__.py
 authlib/oidc/core/__init__.py
+authlib/oidc/core/authorization_request.py
 authlib/oidc/core/claims.py
 authlib/oidc/core/errors.py
 authlib/oidc/core/models.py

authlib-1.9.0/Authlib.egg-info/requires.txt

@@ -0,0 +1,2 @@
+cryptography>=45.0.1
+joserfc>=1.6.1

{authlib-1.7.2 → authlib-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.7.2
+Version: 1.9.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -32,8 +32,8 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cryptography
-Requires-Dist: joserfc>=1.6.0
+Requires-Dist: cryptography>=45.0.1
+Requires-Dist: joserfc>=1.6.1
 Dynamic: license-file
 
 <div align="center">

authlib-1.9.0/authlib/common/security.py

@@ -0,0 +1,48 @@
+import ipaddress
+import os
+import random
+import string
+from urllib.parse import urlsplit
+
+UNICODE_ASCII_CHARACTER_SET = string.ascii_letters + string.digits
+
+
+def generate_token(length=30, chars=UNICODE_ASCII_CHARACTER_SET):
+    rand = random.SystemRandom()
+    return "".join(rand.choice(chars) for _ in range(length))
+
+
+def is_secure_transport(uri):
+    """Check if the uri is over ssl."""
+    if os.getenv("AUTHLIB_INSECURE_TRANSPORT"):
+        return True
+
+    try:
+        parts = urlsplit(uri)
+    except ValueError:
+        return False
+
+    if not parts.hostname:
+        return False
+
+    if parts.scheme == "https":
+        return True
+
+    if parts.scheme != "http":
+        return False
+
+    # rfc8252 §7.3: native apps may use http for loopback redirection URIs.
+    if parts.hostname == "localhost":
+        return True
+
+    try:
+        address = ipaddress.ip_address(parts.hostname)
+    except ValueError:
+        return False
+
+    # IPv6Address.is_loopback only accounts for the mapped IPv4 address since
+    # CPython 3.10.16, 3.11.11 and 3.12.4.
+    if isinstance(address, ipaddress.IPv6Address) and address.ipv4_mapped:
+        address = address.ipv4_mapped
+
+    return address.is_loopback

{authlib-1.7.2 → authlib-1.9.0}/authlib/common/urls.py

@@ -140,7 +140,16 @@ def extract_params(raw):
 
 
 def is_valid_url(url: str, fragments_allowed=True):
-    parsed = urlparse.urlparse(url)
-    return (
+    try:
+        parsed = urlparse.urlparse(url)
+    except ValueError:
+        return False
+
+    # The userinfo component can disguise the actual host,
+    # as in "https://provider.test@attacker.test/".
+    if "@" in parsed.netloc:
+        return False
+
+    return bool(
         parsed.scheme and parsed.hostname and (fragments_allowed or not parsed.fragment)
     )

{authlib-1.7.2 → authlib-1.9.0}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.7.2"
+version = "1.9.0"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/base_client/async_openid.py

@@ -1,6 +1,7 @@
 from joserfc import jwt
 from joserfc.errors import InvalidKeyIdError
 from joserfc.jwk import KeySet
+from joserfc.jws import JWSRegistry
 
 from authlib.common.security import generate_token
 from authlib.common.urls import add_params_to_uri
@@ -42,6 +43,9 @@ class AsyncOpenIDMixin:
         self, token, nonce, claims_options=None, claims_cls=None, leeway=120
     ):
         """Return an instance of UserInfo from token's ``id_token``."""
+        if "id_token" not in token:
+            return None
+
         claims_params = dict(
             nonce=nonce,
             client_id=self.client_id,
@@ -67,7 +71,7 @@ class AsyncOpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
         except InvalidKeyIdError:
             jwks = await self.fetch_jwk_set(force=True)
@@ -75,13 +79,10 @@ class AsyncOpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)
-        # https://github.com/authlib/authlib/issues/259
-        if claims.get("nonce_supported") is False:
-            claims.params["nonce"] = None
         claims.validate(leeway=leeway)
         return UserInfo(claims)
 

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/base_client/sync_openid.py

@@ -1,6 +1,7 @@
 from joserfc import jwt
 from joserfc.errors import InvalidKeyIdError
 from joserfc.jwk import KeySet
+from joserfc.jws import JWSRegistry
 
 from authlib.common.security import generate_token
 from authlib.common.urls import add_params_to_uri
@@ -39,7 +40,11 @@ class OpenIDMixin:
     def parse_id_token(
         self, token, nonce, claims_options=None, claims_cls=None, leeway=120
     ):
-        """Return an instance of UserInfo from token's ``id_token``."""
+        """Return UserInfo after validating the token's ``id_token``.
+
+        The expected ``nonce`` is controlled by the application. Token claims
+        such as ``nonce_supported`` cannot disable its validation.
+        """
         if "id_token" not in token:
             return None
 
@@ -66,21 +71,17 @@ class OpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
         except InvalidKeyIdError:
             key_set = KeySet.import_key_set(self.fetch_jwk_set(force=True))
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)
-        # https://github.com/authlib/authlib/issues/259
-        if claims.get("nonce_supported") is False:
-            claims.params["nonce"] = None
-
         claims.validate(leeway=leeway)
         return UserInfo(claims)
 

authlib-1.9.0/authlib/integrations/httpx_client/_compat.py

@@ -0,0 +1,16 @@
+"""Compatibility shim for httpx2 with legacy httpx fallback.
+
+Falls back to httpx when httpx2 is unavailable. The fallback is deprecated
+and will be removed in a future release.
+"""
+
+from authlib.deprecate import deprecate
+
+try:
+    import httpx2
+except ImportError:
+    import httpx as httpx2
+
+    deprecate("The httpx module is deprecated; please use httpx2 instead.")
+
+__all__ = ["httpx2"]

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/httpx_client/assertion_client.py

@@ -1,18 +1,18 @@
-import httpx
-from httpx import USE_CLIENT_DEFAULT
-from httpx import Response
-
 from authlib.oauth2.rfc7521 import AssertionClient as _AssertionClient
 from authlib.oauth2.rfc7523 import JWTBearerGrant
 
 from ..base_client import OAuthError
+from ._compat import httpx2
 from .oauth2_client import OAuth2Auth
 from .utils import extract_client_kwargs
 
+USE_CLIENT_DEFAULT = httpx2.USE_CLIENT_DEFAULT
+Response = httpx2.Response
+
 __all__ = ["AsyncAssertionClient"]
 
 
-class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
+class AsyncAssertionClient(_AssertionClient, httpx2.AsyncClient):
     token_auth_class = OAuth2Auth
     oauth_error_class = OAuthError
     JWT_BEARER_GRANT_TYPE = JWTBearerGrant.GRANT_TYPE
@@ -31,10 +31,11 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         **kwargs,
     ):
         client_kwargs = extract_client_kwargs(kwargs)
-        httpx.AsyncClient.__init__(self, **client_kwargs)
+        httpx2.AsyncClient.__init__(self, **client_kwargs)
 
         _AssertionClient.__init__(
             self,
@@ -47,6 +48,7 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             **kwargs,
         )
 
@@ -69,7 +71,7 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
         return self.parse_response_token(resp)
 
 
-class AssertionClient(_AssertionClient, httpx.Client):
+class AssertionClient(_AssertionClient, httpx2.Client):
     token_auth_class = OAuth2Auth
     oauth_error_class = OAuthError
     JWT_BEARER_GRANT_TYPE = JWTBearerGrant.GRANT_TYPE
@@ -88,15 +90,11 @@ class AssertionClient(_AssertionClient, httpx.Client):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         **kwargs,
     ):
         client_kwargs = extract_client_kwargs(kwargs)
-        # app keyword was dropped!
-        app_value = client_kwargs.pop("app", None)
-        if app_value is not None:
-            client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **client_kwargs)
+        httpx2.Client.__init__(self, **client_kwargs)
 
         _AssertionClient.__init__(
             self,
@@ -109,6 +107,7 @@ class AssertionClient(_AssertionClient, httpx.Client):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             **kwargs,
         )
 

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/httpx_client/oauth1_client.py

@@ -1,10 +1,5 @@
 import typing
 
-import httpx
-from httpx import Auth
-from httpx import Request
-from httpx import Response
-
 from authlib.common.encoding import to_unicode
 from authlib.oauth1 import SIGNATURE_HMAC_SHA1
 from authlib.oauth1 import SIGNATURE_TYPE_HEADER
@@ -12,12 +7,17 @@ from authlib.oauth1 import ClientAuth
 from authlib.oauth1.client import OAuth1Client as _OAuth1Client
 
 from ..base_client import OAuthError
+from ._compat import httpx2
 from .utils import build_request
 from .utils import extract_client_kwargs
 
+Auth = httpx2.Auth
+Request = httpx2.Request
+Response = httpx2.Response
+
 
 class OAuth1Auth(Auth, ClientAuth):
-    """Signs the httpx request using OAuth 1 (RFC5849)."""
+    """Signs the httpx2 request using OAuth 1 (RFC5849)."""
 
     requires_request_body = True
 
@@ -31,7 +31,7 @@ class OAuth1Auth(Auth, ClientAuth):
         )
 
 
-class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient):
+class AsyncOAuth1Client(_OAuth1Client, httpx2.AsyncClient):
     auth_class = OAuth1Auth
 
     def __init__(
@@ -49,7 +49,7 @@ class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient):
         **kwargs,
     ):
         _client_kwargs = extract_client_kwargs(kwargs)
-        httpx.AsyncClient.__init__(self, **_client_kwargs)
+        httpx2.AsyncClient.__init__(self, **_client_kwargs)
 
         _OAuth1Client.__init__(
             self,
@@ -99,7 +99,7 @@ class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient):
         raise OAuthError(error_type, error_description)
 
 
-class OAuth1Client(_OAuth1Client, httpx.Client):
+class OAuth1Client(_OAuth1Client, httpx2.Client):
     auth_class = OAuth1Auth
 
     def __init__(
@@ -117,12 +117,7 @@ class OAuth1Client(_OAuth1Client, httpx.Client):
         **kwargs,
     ):
         _client_kwargs = extract_client_kwargs(kwargs)
-        # app keyword was dropped!
-        app_value = _client_kwargs.pop("app", None)
-        if app_value is not None:
-            _client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **_client_kwargs)
+        httpx2.Client.__init__(self, **_client_kwargs)
 
         _OAuth1Client.__init__(
             self,

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/httpx_client/oauth2_client.py

@@ -1,12 +1,11 @@
+# ruff: noqa: I001
+# The import order below is intentional: httpx compatibility must be loaded
+# before anyio so import errors refer to httpx.
 import typing
 from contextlib import asynccontextmanager
 
-import httpx
+from ._compat import httpx2
 from anyio import Lock  # Import after httpx so import errors refer to httpx
-from httpx import USE_CLIENT_DEFAULT
-from httpx import Auth
-from httpx import Request
-from httpx import Response
 
 from authlib.common.urls import url_decode
 from authlib.oauth2.auth import ClientAuth
@@ -20,6 +19,11 @@ from ..base_client import UnsupportedTokenTypeError
 from .utils import HTTPX_CLIENT_KWARGS
 from .utils import build_request
 
+USE_CLIENT_DEFAULT = httpx2.USE_CLIENT_DEFAULT
+Auth = httpx2.Auth
+Request = httpx2.Request
+Response = httpx2.Response
+
 __all__ = [
     "OAuth2Auth",
     "OAuth2ClientAuth",
@@ -60,7 +64,7 @@ class OAuth2ClientAuth(Auth, ClientAuth):
         )
 
 
-class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient):
+class AsyncOAuth2Client(_OAuth2Client, httpx2.AsyncClient):
     SESSION_REQUEST_PARAMS = HTTPX_CLIENT_KWARGS
 
     client_auth_class = OAuth2ClientAuth
@@ -81,9 +85,9 @@ class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient):
         leeway=60,
         **kwargs,
     ):
-        # extract httpx.Client kwargs
+        # extract httpx2.Client kwargs
         client_kwargs = self._extract_session_request_params(kwargs)
-        httpx.AsyncClient.__init__(self, **client_kwargs)
+        httpx2.AsyncClient.__init__(self, **client_kwargs)
 
         # We use a Lock to synchronize coroutines to prevent
         # multiple concurrent attempts to refresh the same token
@@ -208,7 +212,7 @@ class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient):
         )
 
 
-class OAuth2Client(_OAuth2Client, httpx.Client):
+class OAuth2Client(_OAuth2Client, httpx2.Client):
     SESSION_REQUEST_PARAMS = HTTPX_CLIENT_KWARGS
 
     client_auth_class = OAuth2ClientAuth
@@ -228,14 +232,9 @@ class OAuth2Client(_OAuth2Client, httpx.Client):
         update_token=None,
         **kwargs,
     ):
-        # extract httpx.Client kwargs
+        # extract httpx2.Client kwargs
         client_kwargs = self._extract_session_request_params(kwargs)
-        # app keyword was dropped!
-        app_value = client_kwargs.pop("app", None)
-        if app_value is not None:
-            client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **client_kwargs)
+        httpx2.Client.__init__(self, **client_kwargs)
 
         _OAuth2Client.__init__(
             self,

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/httpx_client/utils.py

@@ -1,4 +1,6 @@
-from httpx import Request
+from ._compat import httpx2
+
+Request = httpx2.Request
 
 HTTPX_CLIENT_KWARGS = [
     "headers",
@@ -32,7 +34,10 @@ def extract_client_kwargs(kwargs):
 def build_request(url, headers, body, initial_request: Request) -> Request:
     """Make sure that all the data from initial request is passed to the updated object."""
     updated_request = Request(
-        method=initial_request.method, url=url, headers=headers, content=body
+        method=initial_request.method,
+        url=url,
+        headers=headers,
+        content=body,
     )
 
     if hasattr(initial_request, "extensions"):

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/requests_client/assertion_session.py

@@ -17,9 +17,7 @@ class AssertionAuth(OAuth2Auth):
 
 class AssertionSession(AssertionClient, Session):
     """Constructs a new Assertion Framework for OAuth 2.0 Authorization Grants
-    per RFC7521_.
-
-    .. _RFC7521: https://tools.ietf.org/html/rfc7521
+    per :rfc:`7521`.
     """
 
     token_auth_class = AssertionAuth
@@ -39,6 +37,7 @@ class AssertionSession(AssertionClient, Session):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         default_timeout=None,
         leeway=60,
         **kwargs,
@@ -57,6 +56,7 @@ class AssertionSession(AssertionClient, Session):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             leeway=leeway,
             **kwargs,
         )

{authlib-1.7.2 → authlib-1.9.0}/authlib/integrations/sqla_oauth2/client_mixin.py

@@ -22,9 +22,7 @@ class OAuth2ClientMixin(ClientMixin):
     @property
     def client_info(self):
         """Implementation for Client Info in OAuth 2.0 Dynamic Client
-        Registration Protocol via `Section 3.2.1`_.
-
-        .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc7591#section-3.2.1
+        Registration Protocol via :rfc:`7591#section-3.2.1`.
         """
         return dict(
             client_id=self.client_id,

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/drafts/_jwe_enc_cryptodome.py

@@ -1,9 +1,8 @@
 """authlib.jose.draft.
 ~~~~~~~~~~~~~~~~~~~~
 
-Content Encryption per `Section 4`_.
-
-.. _`Section 4`: https://datatracker.ietf.org/doc/html/draft-amringer-jose-chacha-02#section-4
+Content Encryption per
+:draft:`draft-amringer-jose-chacha-02 Section 4 <draft-amringer-jose-chacha-02#section-4>`.
 """
 
 from Cryptodome.Cipher import ChaCha20_Poly1305 as Cryptodome_ChaCha20_Poly1305

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/drafts/_jwe_enc_cryptography.py

@@ -1,9 +1,8 @@
 """authlib.jose.draft.
 ~~~~~~~~~~~~~~~~~~~~
 
-Content Encryption per `Section 4`_.
-
-.. _`Section 4`: https://datatracker.ietf.org/doc/html/draft-amringer-jose-chacha-02#section-4
+Content Encryption per
+:draft:`draft-amringer-jose-chacha-02 Section 4 <draft-amringer-jose-chacha-02#section-4>`.
 """
 
 from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/rfc7515/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Signature (JWS).
 
-https://tools.ietf.org/html/rfc7515
+:rfc:`7515`
 """
 
 from .jws import JsonWebSignature

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/rfc7515/jws.py

@@ -52,7 +52,7 @@ class JsonWebSignature:
     def serialize_compact(self, protected, payload, key):
         """Generate a JWS Compact Serialization. The JWS Compact Serialization
         represents digitally signed or MACed content as a compact, URL-safe
-        string, per `Section 7.1`_.
+        string, per :rfc:`7515#section-7.1`.
 
         .. code-block:: text
 
@@ -81,15 +81,13 @@ class JsonWebSignature:
     def deserialize_compact(self, s, key, decode=None):
         """Exact JWS Compact Serialization, and validate with the given key.
         If key is not provided, the returned dict will contain the signature,
-        and signing input values. Via `Section 7.1`_.
+        and signing input values. Via :rfc:`7515#section-7.1`.
 
         :param s: text of JWS Compact Serialization
         :param key: key used to verify the signature
         :param decode: a function to decode payload data
         :return: JWSObject
         :raise: BadSignatureError
-
-        .. _`Section 7.1`: https://tools.ietf.org/html/rfc7515#section-7.1
         """
         if len(s) > self.MAX_CONTENT_LENGTH:
             raise ValueError("Serialization is too long.")
@@ -119,7 +117,7 @@ class JsonWebSignature:
     def serialize_json(self, header_obj, payload, key):
         """Generate a JWS JSON Serialization. The JWS JSON Serialization
         represents digitally signed or MACed content as a JSON object,
-        per `Section 7.2`_.
+        per :rfc:`7515#section-7.2`.
 
         :param header_obj: A dict/list of header
         :param payload: A string/dict of payload
@@ -170,15 +168,13 @@ class JsonWebSignature:
     def deserialize_json(self, obj, key, decode=None):
         """Exact JWS JSON Serialization, and validate with the given key.
         If key is not provided, it will return a dict without signature
-        verification. Header will still be validated. Via `Section 7.2`_.
+        verification. Header will still be validated. Via :rfc:`7515#section-7.2`.
 
         :param obj: text of JWS JSON Serialization
         :param key: key used to verify the signature
         :param decode: a function to decode payload data
         :return: JWSObject
         :raise: BadSignatureError
-
-        .. _`Section 7.2`: https://tools.ietf.org/html/rfc7515#section-7.2
         """
         obj = ensure_dict(obj, "JWS")
 
@@ -204,6 +200,11 @@ class JsonWebSignature:
 
         headers = []
         is_valid = True
+
+        # invalidates cases like obj["signatures"] = None or obj["signatures"] = []
+        if not obj["signatures"]:
+            is_valid = False
+
         for header_obj in obj["signatures"]:
             jws_header, valid = self._validate_json_jws(
                 payload_segment, payload, header_obj, key

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/rfc7516/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Encryption (JWE).
 
-https://tools.ietf.org/html/rfc7516
+:rfc:`7516`
 """
 
 from .jwe import JsonWebEncryption

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/rfc7517/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Key (JWK).
 
-https://tools.ietf.org/html/rfc7517
+:rfc:`7517`
 """
 
 from ._cryptography_key import load_pem_key

{authlib-1.7.2 → authlib-1.9.0}/authlib/jose/rfc7518/jwe_encs.py

@@ -2,9 +2,7 @@
 ~~~~~~~~~~~~~~~~~~~~
 
 Cryptographic Algorithms for Cryptographic Algorithms for Content
-Encryption per `Section 5`_.
-
-.. _`Section 5`: https://tools.ietf.org/html/rfc7518#section-5
+Encryption per :rfc:`7518#section-5`.
 """
 
 import hashlib