Skip to content

Fix jwt token validation#162

Closed
gauravsingh001-cyber wants to merge 1 commit into
Stanzin7:masterfrom
gauravsingh001-cyber:fix-jwt-token-validation
Closed

Fix jwt token validation#162
gauravsingh001-cyber wants to merge 1 commit into
Stanzin7:masterfrom
gauravsingh001-cyber:fix-jwt-token-validation

Conversation

@gauravsingh001-cyber

Copy link
Copy Markdown
Contributor

fix #158

Fix: Prevent backend crash on malformed JWT token

Issue

The backend crashes when a malformed JWT token is passed due to this line:

message, encoded_sig = token.rsplit(".", 1)

This raises:
ValueError: not enough values to unpack

Fix

Added validation to ensure token has correct structure (3 parts) before splitting.

Changes

  • Added safe token validation using:
    parts = token.split(".")
    if len(parts) != 3:
    return None

Result

  • Prevents backend crashes
  • Handles invalid tokens gracefully
  • Improves API stability

Testing

  • Sent malformed token using curl
  • Verified server does not crash
  • Valid tokens still work as expected

@Stanzin7

Copy link
Copy Markdown
Owner

Thanks @gauravsingh001-cyber , but this targets a non-issue on current master. The line message, encoded_sig = token.rsplit(".", 1) (api/supabase_auth.py:106) is already inside the try block (opens at :85) whose except Exception: return None (:144-145) catches the ValueError a malformed token would raise — so a bad token returns None/401, not a crash. I verified this empirically. Closing along with #158, which reports the same thing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Backend crashes on malformed JWT token due to missing validation

2 participants