Skip to content

fix(signer): Mark a JWT failure if payload conversion fail - #387

Merged
jclapis merged 1 commit into
sigp-audit-fixesfrom
mark_jwt_failure_widely
Oct 20, 2025
Merged

fix(signer): Mark a JWT failure if payload conversion fail#387
jclapis merged 1 commit into
sigp-audit-fixesfrom
mark_jwt_failure_widely

Conversation

@ManuelBilbao

@ManuelBilbaoManuelBilbao commented Oct 1, 2025

Copy link
Copy Markdown
Collaborator

We weren't marking a failure request if the payload conversion to Bytes failed (e.g., because of exceeding the max body length). This could lead to a rate limit bypass for DoS

@ManuelBilbaoManuelBilbao self-assigned this Oct 1, 2025
@ManuelBilbaoManuelBilbao added the signer Signer module label Oct 1, 2025
@jclapis
jclapis merged commit a3f8d9d into sigp-audit-fixesOct 20, 2025
1 check failed
@jclapis
jclapis deleted the mark_jwt_failure_widely branch October 20, 2025 15:19
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@jclapisjclapisjclapis approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@ManuelBilbaoManuelBilbao

Labels

signerSigner module

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ManuelBilbao@jclapis