Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-27 22:49:56 -05:00
Code Issues Activity

Removed whitelist of JWT errors

Browse source 
refs https://linear.app/tryghost/issue/ENG-712/

I don't think we ever need to respond with a 500 here, if the verify call
fails, we know that the token is unauthorized for use.
This commit is contained in:
Fabien O'Carroll 2024-03-04 10:58:17 -05:00 • committed by Fabien 'egg' O'Carroll
parent dcbd168585
commit d9fb4787ec
1 changed files with 5 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ghost/core/core/server/services/auth/api-key/admin.js
View file

@ -159,7 +159,6 @@ const authenticateWithToken = async function apiKeyAuthenticateWithToken(req, re
try { try {
jwt.verify(token, secret, options); jwt.verify(token, secret, options);
} catch (err) { } catch (err) {
if (err.name === 'TokenExpiredError' || err.name === 'JsonWebTokenError' || err.name === 'NotBeforeError') {
return next(new errors.UnauthorizedError({ return next(new errors.UnauthorizedError({
message: tpl(messages.invalidTokenWithMessage, {message: err.message}), message: tpl(messages.invalidTokenWithMessage, {message: err.message}),
code: 'INVALID_JWT', code: 'INVALID_JWT',
@ -167,10 +166,6 @@ const authenticateWithToken = async function apiKeyAuthenticateWithToken(req, re
})); }));
} }
// unknown error
return next(new errors.InternalServerError({err}));
}
// authenticated OK // authenticated OK
if (apiKey.get('user_id')) { if (apiKey.get('user_id')) {