How to use the authlib.jose.errors.InvalidClaimError function in Authlib

To help you get started, we’ve selected a few Authlib examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github lepture / authlib / authlib / jose / rfc7519 / claims.py View on Github external
def validate_iat(self, now, leeway):
        """The "iat" (issued at) claim identifies the time at which the JWT was
        issued.  This claim can be used to determine the age of the JWT.  Its
        value MUST be a number containing a NumericDate value.  Use of this
        claim is OPTIONAL.
        """
        iat = self.get('iat')
        if iat and not isinstance(iat, int):
            raise InvalidClaimError('iat')
github lepture / authlib / authlib / jose / rfc7519 / claims.py View on Github external
def _validate_claim_value(self, claim_name):
        option = self.options.get(claim_name)
        value = self.get(claim_name)
        if not option or not value:
            return

        option_value = option.get('value')
        if option_value and value != option_value:
            raise InvalidClaimError(claim_name)

        option_values = option.get('values')
        if option_values and value not in option_values:
            raise InvalidClaimError(claim_name)

        validate = option.get('validate')
        if validate and not validate(self, value):
            raise InvalidClaimError(claim_name)
github lepture / authlib / authlib / jose / rfc7519 / claims.py View on Github external
def validate_exp(self, now, leeway):
        """The "exp" (expiration time) claim identifies the expiration time on
        or after which the JWT MUST NOT be accepted for processing.  The
        processing of the "exp" claim requires that the current date/time
        MUST be before the expiration date/time listed in the "exp" claim.
        Implementers MAY provide for some small leeway, usually no more than
        a few minutes, to account for clock skew.  Its value MUST be a number
        containing a NumericDate value.  Use of this claim is OPTIONAL.
        """
        exp = self.get('exp')
        if exp:
            if not isinstance(exp, int):
                raise InvalidClaimError('exp')
            if exp < (now - leeway):
                raise ExpiredTokenError()
github lepture / authlib / authlib / oidc / core / claims.py View on Github external
def validate_amr(self):
        """OPTIONAL. Authentication Methods References. JSON array of strings
        that are identifiers for authentication methods used in the
        authentication. For instance, values might indicate that both password
        and OTP authentication methods were used. The definition of particular
        values to be used in the amr Claim is beyond the scope of this
        specification. Parties using this claim will need to agree upon the
        meanings of the values used, which may be context-specific. The amr
        value is an array of case sensitive strings.
        """
        amr = self.get('amr')
        if amr and not isinstance(self['amr'], list):
            raise InvalidClaimError('amr')
github lepture / authlib / authlib / oidc / core / claims.py View on Github external
of the code value, where the hash algorithm used is the hash algorithm
        used in the alg Header Parameter of the ID Token's JOSE Header. For
        instance, if the alg is HS512, hash the code value with SHA-512, then
        take the left-most 256 bits and base64url encode them. The c_hash
        value is a case sensitive string.
        If the ID Token is issued from the Authorization Endpoint with a code,
        which is the case for the response_type values code id_token and code
        id_token token, this is REQUIRED; otherwise, its inclusion is OPTIONAL.
        """
        code = self.params.get('code')
        c_hash = self.get('c_hash')
        if code:
            if not c_hash:
                raise MissingClaimError('c_hash')
            if not _verify_hash(c_hash, code, self.header['alg']):
                raise InvalidClaimError('c_hash')
github lepture / authlib / authlib / jose / rfc7519 / claims.py View on Github external
def validate_nbf(self, now, leeway):
        """The "nbf" (not before) claim identifies the time before which the JWT
        MUST NOT be accepted for processing.  The processing of the "nbf"
        claim requires that the current date/time MUST be after or equal to
        the not-before date/time listed in the "nbf" claim.  Implementers MAY
        provide for some small leeway, usually no more than a few minutes, to
        account for clock skew.  Its value MUST be a number containing a
        NumericDate value.  Use of this claim is OPTIONAL.
        """
        nbf = self.get('nbf')
        if nbf:
            if not isinstance(nbf, int):
                raise InvalidClaimError('nbf')
            if nbf > (now + leeway):
                raise InvalidTokenError()
github lepture / authlib / authlib / oauth2 / rfc7591 / claims.py View on Github external
def _validate_uri(self, key, uri=None):
        if uri is None:
            uri = self.get(key)
        if uri and not is_valid_url(uri):
            raise InvalidClaimError(key)
github lepture / authlib / authlib / jose / rfc7519 / claims.py View on Github external
aud_values = aud_option.get('values')
        if not aud_values:
            aud_value = aud_option.get('value')
            if aud_value:
                aud_values = [aud_value]

        if not aud_values:
            return

        if isinstance(self['aud'], list):
            aud_list = self['aud']
        else:
            aud_list = [self['aud']]

        if not any([v in aud_list for v in aud_values]):
            raise InvalidClaimError('aud')