New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate to github.com/golang-jwt/jwt/v4 to address CVE-2020-26160 #277

Closed

JorritSalverda opened this issue Aug 27, 2021 · 0 comments · Fixed by #278

Contributor

JorritSalverda commented Aug 27, 2021

github.com/golang-jwt/jwt is a drop-in replacement for github.com/dgrijalva/jwt-go.

Version 4 - see https://github.com/golang-jwt/jwt/blob/main/MIGRATION_GUIDE.md - fixes vulnerability CVE-2020-26160 and does away with checking the issued at time, which is not supposed to be checked according to the JWT spec but can lead to Token used before issued errors.

The text was updated successfully, but these errors were encountered:

JorritSalverda mentioned this issue

replace deprecated github.com/dgrijalva/jwt-go with github.com/golang-jwt/jwt/v4 #278

Merged

appleboy closed this as completed in #278

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment