Olivier Dumont ef157ae9ba Fix critical security issue: verify JWT signature in access token validation ...

The validateAccessToken method was only decoding the JWT payload without
verifying the signature, allowing attackers to forge tokens. This fix:

- Adds ValidateAccessToken method to OIDCService that properly verifies
  JWT signature using RSA public key
- Validates issuer, expiration, and required claims
- Updates controller to use the secure validation method
- Removes insecure manual JWT parsing code

2025-12-30 12:36:30 +01:00

12 KiB

Raw Blame History

View Raw