Fixing a bug - the allows_jwt method does NOT throw any error if a token is not found at all.

This could cause potential security issues as developers decorate their methods with @allows_jwt and then not pass a token and the method allows the call. Signed-off-by: Gautham <buzypi@gmail.com>
2018-07-24 15:12:20 +05:30
parent d7624b95f8
commit bc59d58a3e
1 changed files with 2 additions and 0 deletions
@@ -1335,6 +1335,8 @@ class AuthJWT(object):
                    if required:
                        raise e
                    token = None
+                if not token:
+                    raise HTTP(400, 'Invalid token')
                if token and len(token) < self.max_header_length:
                    old_verify_expiration = self.verify_expiration
                    try: