779950 - Verify JWT claims

Status: RESOLVED INVALID

(Marketplace Graveyard :: Payments/Refunds, defect, P5)

Description

[Andy McKay]

To prevent re-use of JWT, we should be verifying the claims in the JWT. Kumar does this in inapp pay, but we should do it as well in solitude to prevent the re-use of JWT tokens.

http://moz-inapp-pay.readthedocs.org/en/latest/#moz_inapp_pay.verify.verify_claims

Comment 1

[Kumar McMillan [:kumar]]

you mean just for solitude's JWT communication with Marketplace, right?

Comment 2

[Andy McKay]

yup, but there's no reason we can't do the checks for other relevant jwt's too

Comment 3

[Kumar McMillan [:kumar]]

I'm working on a patch to verify claims of the BlueVia JWT in Marketplace after we verify the sig using solitude.

Comment 4

[Andy McKay]

Sounds good.