From 9e8ca0e630b85fd8f5e138c242307bc311713040 Mon Sep 17 00:00:00 2001 From: Donald Zou Date: Wed, 1 Jul 2026 16:36:17 +0800 Subject: [PATCH] Updated OIDC Algorithm Fallback --- src/modules/DashboardOIDC.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/modules/DashboardOIDC.py b/src/modules/DashboardOIDC.py index 6693b233..4a41a6f1 100644 --- a/src/modules/DashboardOIDC.py +++ b/src/modules/DashboardOIDC.py @@ -82,13 +82,18 @@ class DashboardOIDC: headers = jwt.get_unverified_header(id_token) kid = headers["kid"] - + key = next(k for k in jwks["keys"] if k["kid"] == kid) - + + alg = key.get("alg") or headers.get("alg") + supported_algs = oidc_config.get("id_token_signing_alg_values_supported") + if supported_algs and alg not in supported_algs: + return False, f"Unsupported token signing algorithm: {alg}" + payload = jwt.decode( id_token, key, - algorithms=[key["alg"]], + algorithms=[alg], audience=provider_info.get('client_id'), issuer=issuer, access_token=access_token