JWT Handler Add missing TokenRejectionException#58
JWT Handler Add missing TokenRejectionException#58lmajano merged 1 commit intocoldbox-modules:developmentfrom
Conversation
Update setErrorMessage calls to match spec Update test to check response message
There was a problem hiding this comment.
Pull request overview
This PR fixes a missing exception handler in the JWT refresh token endpoint and updates error handling to reduce information exposure. The PR adds a catch block for TokenRejectionException thrown when a token is not found in storage, updates setErrorMessage calls to match the current API signature (removing the third parameter), and improves security by removing detailed error messages that could leak implementation details.
Changes:
- Added
TokenRejectionExceptioncatch block inhandlers/Jwt.cfcto handle tokens rejected by storage validation - Updated all
setErrorMessagecalls to use two-parameter signature (message, statusCode) instead of three - Removed detailed error messages (e.g.,
#e.message#) to prevent information disclosure - Enhanced test coverage for invalidated refresh tokens
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| handlers/Jwt.cfc | Added missing TokenRejectionException catch block and simplified error messages by removing the third parameter and detailed exception information |
| test-harness/tests/specs/integration/JWTSpec.cfc | Updated test to use a valid token that is then invalidated (instead of an invalid token string) to properly test the TokenRejectionException scenario |
| ); | ||
|
|
||
| var jsonResponse = deserializeJSON( event.getRenderedContent() ); | ||
| expect( jsonResponse.messages[ 1 ] ).toBe( event.getResponse().getMessagesString() ); |
There was a problem hiding this comment.
This assertion appears redundant - it's comparing the first message from the JSON response to the messages string from the response, which should always match since they're derived from the same source. Consider removing this assertion or clarifying what specific behavior it's validating.
2 participants
Description
The JWT refresh token handler was not catching the
TokenRejectionExceptionthrown injwtService.parseToken()Updated the setErrorMessage calls to match the latest spec
Response function setErrorMessage( required errorMessage, statusCode )Updated the actual error messages to not returned detailed response. Sometimes, this goes into too much detail, which could be a potential security risk exposing more information than necessary. Maybe this could use the Coldbox
inDebugMode()flag to check and add this, but I'm not sure how to wire that up properly at this moment.Type of change
Checklist