Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NullPointerException when the claim doesn't exist in the token #384

Closed
Raph22 opened this issue Feb 11, 2020 · 2 comments · Fixed by #393
Closed

NullPointerException when the claim doesn't exist in the token #384

Raph22 opened this issue Feb 11, 2020 · 2 comments · Fixed by #393
Assignees
Labels
bug This points to a verified bug in the code
Milestone

Comments

@Raph22
Copy link

Raph22 commented Feb 11, 2020

Description

I am not sure this behaviour is the one expected. When I try to verify a token with a claim that is not present in the token I got a NullPointerException.

Reproduction

I got it in my own code and here's a scratch to reproduce it:

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;

class Scratch {
    public static void main(String[] args) {
        String token = JWT
                .create()
                .withArrayClaim("array", new Integer[]{1, 2, 3})
                .sign(Algorithm.HMAC256("secret"));


        JWTVerifier verifier = JWT
                .require(Algorithm.HMAC256("secret"))
                .withArrayClaim("arrtay", 1, 2, 3).build(); // <== arrtay is not array

        verifier.verify(token); 
    }
}

StackTrace

Exception in thread "main" java.lang.NullPointerException
	at java.util.Objects.requireNonNull(Objects.java:203)
	at java.util.Arrays$ArrayList.<init>(Arrays.java:3813)
	at java.util.Arrays.asList(Arrays.java:3800)
	at com.auth0.jwt.JWTVerifier.assertValidClaim(JWTVerifier.java:412)
	at com.auth0.jwt.JWTVerifier.verifyClaims(JWTVerifier.java:391)
	at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:355)
	at Scratch.main(scratch_1.java:17)

Environment

  • Version of this library used: 3.4.0

Personally I would expect to get a JWTVerificationException or InvalidClaimException.

@Raph22 Raph22 changed the title NullPointerException when the claims doesn't exist in the token NullPointerException when the claim doesn't exist in the token Feb 11, 2020
@Raph22
Copy link
Author

Raph22 commented Feb 11, 2020

Sorry I m just realizing that there is more recent version now. I ll test tomorrow if you have changed this behaviour in the latest version and will close it if yes otherwise no.
EDIT: Still the same behaviour in 3.9.0

@lbalmaceda
Copy link
Contributor

Correct, it should throw an InvalidClaimException at least. I'll look into it. Thanks for reaching out!

@lbalmaceda lbalmaceda self-assigned this Feb 12, 2020
@lbalmaceda lbalmaceda added the bug This points to a verified bug in the code label Feb 12, 2020
@lbalmaceda lbalmaceda added this to the v3-Next milestone Feb 14, 2020
@lbalmaceda lbalmaceda modified the milestones: v3-Next, 3.10.0 Feb 14, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This points to a verified bug in the code
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants