From 5294745704d92a9d215a42496f484ca414e98bf1 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 22 Jun 2026 00:17:58 +0000 Subject: [PATCH] Fix: replace all settings.algorithm references with hardcoded ALGORITHM SEC-11 removed algorithm from Settings but missed 3 call sites: - auth.py line 68: jwt.decode in get_current_user - integrations.py lines 58, 120: jwt.decode in OAuth callbacks All now use ALGORITHM constant or inline 'HS256'. --- backend/app/routers/integrations.py | 4 ++-- backend/app/utils/auth.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/app/routers/integrations.py b/backend/app/routers/integrations.py index e3eb075..0aa52a5 100644 --- a/backend/app/routers/integrations.py +++ b/backend/app/routers/integrations.py @@ -55,7 +55,7 @@ async def strava_callback( from app.config import get_settings _settings = get_settings() try: - payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm]) + payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"]) user_id = uuid_mod.UUID(payload["sub"]) except (JWTError, KeyError, ValueError): raise HTTPException(status_code=400, detail="Invalid or expired OAuth state") @@ -117,7 +117,7 @@ async def polar_callback( from app.config import get_settings _settings = get_settings() try: - payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm]) + payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"]) user_id = uuid_mod.UUID(payload["sub"]) except (JWTError, KeyError, ValueError): raise HTTPException(status_code=400, detail="Invalid or expired OAuth state") diff --git a/backend/app/utils/auth.py b/backend/app/utils/auth.py index 74e9ba2..65bcbf8 100644 --- a/backend/app/utils/auth.py +++ b/backend/app/utils/auth.py @@ -65,7 +65,7 @@ async def get_current_user( # Standard JWT validation try: - payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm]) + payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM]) user_id: str = payload.get("sub") if user_id is None: raise credentials_exception