feat: add kid-based signature validation with enhanced error handling #8
+729
−35
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chrisingenhaag
force-pushed
the
fix/properValidation
branch
from
33828ca to
39d34b4
Compare
Implements fallback key selection based on JWT algorithm and key metadata when kid header is missing. Plugin now attempts to find a single unambiguous matching key by comparing JWT algorithm (RS256/384/512, PS256/384/512, ES256/384/512) with key metadata (alg, kty, use). Rejects tokens when multiple keys match or no matching key is found. Adds key_metadata tracking throughout the key retrieval chain and comprehensive test coverage for various
Defines kong-net bridge network and assigns all services to it for improved network isolation and DNS resolution. Adds diagnostic network connectivity test script that validates DNS resolution for kong, kc, and httpbin services during test initialization.
Adds Docker version information output and failure diagnostics that display container status and logs for kong, keycloak, and test services when tests fail. Improves troubleshooting capabilities for CI test failures.
Registers the new validators.signature module in the rockspec build modules list and aligns formatting of validator module entries for consistency.
luispflamminger
left a comment
luispflamminger
left a comment
There was a problem hiding this comment.
I added a couple of comments, mostly for better understanding on my side :)
Co-authored-by: Luis Pflamminger <luis.pflamminger@gmail.com>
chrisingenhaag
force-pushed
the
fix/properValidation
branch
from
07b1102 to
ad3ce5c
Compare
Removes key type (kty) field from key metadata tracking and eliminates kty-based key matching logic. Simplifies algorithm validation to only check explicit alg field matches when present. Updates test descriptions to reflect that keys match when no alg is specified rather than matching by kty. Removes PS256 algorithm test and kid-optional integration test notes that are now covered by unit tests.
chrisingenhaag
force-pushed
the
fix/properValidation
branch
from
ad3ce5c to
6873da0
Compare
luispflamminger
approved these changes
Dec 12, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.