dj-jwt-auth 1.7.0__tar.gz → 1.7.1__tar.gz

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dj-jwt-auth
-Version: 1.7.0
+Version: 1.7.1
 Summary: A Django package for JSON Web Token validation and verification. Using PyJWT.
 Home-page: https://www.example.com/
 Author: Konstantin Seleznev

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/dj_jwt_auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dj-jwt-auth
-Version: 1.7.0
+Version: 1.7.1
 Summary: A Django package for JSON Web Token validation and verification. Using PyJWT.
 Home-page: https://www.example.com/
 Author: Konstantin Seleznev

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/django_jwt/config.py

@@ -6,7 +6,7 @@ import requests
 from jwt.algorithms import ECAlgorithm, RSAAlgorithm
 
 from django_jwt import settings
-from django_jwt.exceptions import ConfigException
+from django_jwt.exceptions import AlgorithmNotSupportedException, ConfigException
 
 
 def ensure_well_known(url: str) -> str:
@@ -24,6 +24,9 @@ class Config:
         if not self.route:
             raise ConfigException("OIDC_CONFIG_ROUTES is not set")
 
+        if alg not in self.route:
+            raise AlgorithmNotSupportedException(f"Algorithm {alg} is not supported")
+
         response = requests.get(ensure_well_known(self.route[alg]))
         response.raise_for_status()
         return response.json()

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/django_jwt/exceptions.py

@@ -8,3 +8,9 @@ class BadRequestException(Exception):
     """Base class for exceptions in this module."""
 
     pass
+
+
+class AlgorithmNotSupportedException(Exception):
+    """Base class for exceptions in this module."""
+
+    pass

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/django_jwt/middleware.py

@@ -5,6 +5,7 @@ from django.http import JsonResponse
 from django.utils.deprecation import MiddlewareMixin
 from jwt import ExpiredSignatureError
 
+from django_jwt.exceptions import AlgorithmNotSupportedException
 from django_jwt.user import UserHandler
 from django_jwt.utils import oidc_handler
 
@@ -27,6 +28,8 @@ class JWTAuthMiddleware(MiddlewareMixin):
         try:
             info = oidc_handler.decode_token(raw_token)
             request.user = request._cached_user = UserHandler(info, request, raw_token).get_user()
+        except AlgorithmNotSupportedException as exc:
+            return JsonResponse(status=HTTPStatus.UNAUTHORIZED.value, data={"detail": str(exc)})
         except ExpiredSignatureError:
             return JsonResponse(status=HTTPStatus.UNAUTHORIZED.value, data={"detail": "expired token"})
         except UnicodeDecodeError as exc:

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = dj-jwt-auth
-version = 1.7.0
+version = 1.7.1
 description = A Django package for JSON Web Token validation and verification. Using PyJWT.
 long_description = file: README.md
 url = https://www.example.com/

{dj_jwt_auth-1.7.0 → dj_jwt_auth-1.7.1}/tests/test.py

@@ -9,6 +9,8 @@ from django.urls import reverse
 from jwt.api_jwt import ExpiredSignatureError
 
 from django_jwt import settings
+from django_jwt.config import config
+from django_jwt.exceptions import ConfigException
 from django_jwt.middleware import JWTAuthMiddleware
 from django_jwt.roles import ROLE
 from django_jwt.user import role_handler
@@ -200,6 +202,25 @@ class OIDCHandlerTest(TestCase):
         # self.assertEqual(user_info.call_count, 1)
 
 
+@patch("django_jwt.utils.get_alg", return_value="HS256")
+class ConfigTest(TestCase):
+    def setUp(self):
+        self.middleware = JWTAuthMiddleware(get_response=lambda x: x)
+        self.request = Mock()
+        self.request.META = {"HTTP_AUTHORIZATION": "Bearer Token"}
+
+    @patch.object(config, "route", {})
+    def test_empty_routes(self, *_):
+        with self.assertRaises(ConfigException):
+            self.middleware.process_request(self.request)
+
+    @patch.object(config, "route", {"ES256": "http://localhost:8080"})
+    def test_not_supported_alg(self, *_):
+        response = self.middleware.process_request(self.request)
+        self.assertEqual(HTTPStatus.UNAUTHORIZED.value, response.status_code)
+        self.assertEqual(b'{"detail": "Algorithm HS256 is not supported"}', response.content)
+
+
 class RolesTest(TestCase):
     def setUp(self) -> None:
         self.user = User.objects.create(username="user")