mazeltovvv
Joined 6 years ago
Karma
20
Submissions
4
Member since
May 21
Recent submissions
Comment · 6 years ago
Interestingly, everytime I hear this I feel like the constitution is treated like the bible, some holy book holding the truth. That is very dangerous imo
Comment · 6 years ago
Ah. So this creates a valid JWT for any email you want, but it is now associated with your own apple account?
Comment · 6 years ago
This is an amazing bug, I am indeed surprised this happened in such a critical protocol. My guess is that nobody must have clearly specified the protocol, and anyone would have been able to catch that in an abstracted english spec.
If this is not the issue, then the implementation might be too complex for people to compare it with the spec (gap between the theory and the practice). I would be extremely interested in a post mortem from Apple.
I have a few follow up questions.
1. seeing how simple the first JWT request is, how can Apple actually authenticate the user at this point?
2. If Apple does not authenticate the user for the first request, how can they check that this bug wasn’t exploited?
3. Anybody can explain what this payload is?
{ "iss": "https://appleid.apple.com", "aud": "com.XXXX.weblogin", "exp": 158XXXXXXX, "iat": 158XXXXXXX, "sub": "XXXX.XXXXX.XXXX", "c_hash": "FJXwx9EHQqXXXXXXXX", "email": "[email protected]", // or "[email protected]" "email_verified": "true", "auth_time": 158XXXXXXX, "nonce_supported": true }
My guess is that c_hash is the hash of the whole payload and it is kept server side.
Comment · 6 years ago
If you’re on vscode it is probably not the moment to switch to rust analyzer. It doesn’t work that well compared to rls. It gets tripped up easily and stops working if your code has bugs. It also doesn’t format on save.