From bc59d58a3e5d9aa422e85a83432e1c44c632132a Mon Sep 17 00:00:00 2001
From: Gautham <gautham@jnaapti.com>
Date: Tue, 24 Jul 2018 15:12:20 +0530
Subject: [PATCH] Fixing a bug - the allows_jwt method does NOT throw any error
 if a token is not found at all.

This could cause potential security issues as developers decorate their methods with @allows_jwt and then not pass a token and the method allows the call.

Signed-off-by: Gautham <buzypi@gmail.com>
---
 gluon/tools.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gluon/tools.py b/gluon/tools.py
index bf4bd902..1078f9eb 100644
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -1335,6 +1335,8 @@ class AuthJWT(object):
                     if required:
                         raise e
                     token = None
+                if not token:
+                    raise HTTP(400, 'Invalid token')
                 if token and len(token) < self.max_header_length:
                     old_verify_expiration = self.verify_expiration
                     try: