scot/diligence
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: replace all settings.algorithm references with hardcoded ALGORITHM

Browse source 
SEC-11 removed algorithm from Settings but missed 3 call sites:
- auth.py line 68: jwt.decode in get_current_user
- integrations.py lines 58, 120: jwt.decode in OAuth callbacks

All now use ALGORITHM constant or inline 'HS256'.
This commit is contained in:
Claude 2026-06-22 00:17:58 +00:00
parent 4e8b321ef8
commit 5294745704
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
backend/app/routers/integrations.py
View file

@ -55,7 +55,7 @@ async def strava_callback(
from app.config import get_settings
_settings = get_settings()
try:
payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm])
payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"])
user_id = uuid_mod.UUID(payload["sub"])
except (JWTError, KeyError, ValueError):
raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")
@ -117,7 +117,7 @@ async def polar_callback(
from app.config import get_settings
_settings = get_settings()
try:
payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm])
payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"])
user_id = uuid_mod.UUID(payload["sub"])
except (JWTError, KeyError, ValueError):
raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")