Merge pull request #3838 from theoDiefenthal/oauth-less-restrictive-key-equalness-check

Less restrictive key equalness check in OAuth due to providers like Microsoft Azure
2018-07-12 16:28:06 -07:00 · 2018-07-12 16:28:06 -07:00 · ad8711a977
parent 8ec536832d cc5bfaadff
commit ad8711a977
1 changed files with 1 additions and 1 deletions
--- a/oauth2/jwt.go
+++ b/oauth2/jwt.go
@ -143,7 +143,7 @@ func (j *JWT) KeyFuncRS256(token *gojwt.Token) (interface{}, error) {
 	// extract cert when kid and alg match
 	var certPkix []byte
 	for _, jwk := range jwks.Keys {
-		if token.Header["kid"] == jwk.Kid && token.Header["alg"] == jwk.Alg {
+		if token.Header["kid"] == jwk.Kid {
 			// FIXME: optionally walk the key chain, see rfc7517 section 4.7
 			certPkix, err = base64.StdEncoding.DecodeString(jwk.X5c[0])
 			if err != nil {