robbert229 / jwt Goto Github PK

package main

import (
	"sync"

	"github.com/robbert229/jwt"
)

func main() {
	algorithm := jwt.HmacSha256("ThisIsTheSecret")
	var wg sync.WaitGroup
	noRoutines := 10
	wg.Add(noRoutines)
	for i := 0; i < noRoutines; i++ {
		go decode(&algorithm, &wg)
	}
	wg.Wait()
}

func decode(algorithm *jwt.Algorithm, wg *sync.WaitGroup) {
	defer wg.Done()
	claims := jwt.NewClaim()
	claims.Set("Role", "Admin")
	token, err := algorithm.Encode(claims)
	if err != nil {
		panic(err)
	}
	for index := 0; index < 100; index++ {
		_, err = algorithm.Decode(token)
		if err != nil {
			panic(err)
		}
	}
}

panic: d.nx != 0

goroutine 7 [running]:
crypto/sha256.(*digest).checkSum(0xc42003fd10, 0x0, 0x0, 0x0, 0x0)
	/usr/local/Cellar/go/1.9.2/libexec/src/crypto/sha256/sha256.go:157 +0x29e
crypto/sha256.(*digest).Sum(0xc420084080, 0x0, 0x0, 0x0, 0x60, 0x5d, 0x0)
	/usr/local/Cellar/go/1.9.2/libexec/src/crypto/sha256/sha256.go:131 +0x69
crypto/hmac.(*hmac).Sum(0xc420052060, 0x0, 0x0, 0x0, 0x5d, 0x0, 0x0)
	/usr/local/Cellar/go/1.9.2/libexec/src/crypto/hmac/hmac.go:46 +0x56
gitlab.com/jwt-test/vendor/github.com/robbert229/jwt.(*Algorithm).sum(0xc42000a060, 0x0, 0x0, 0x0, 0x5d, 0x0, 0x0)
	/myGopath/jwt-test/vendor/github.com/robbert229/jwt/algorithms.go:32 +0x51
gitlab.com/jwt-test/vendor/github.com/robbert229/jwt.(*Algorithm).Sign(0xc42000a060, 0xc4200e4000, 0x5d, 0x1104718, 0x1, 0xc4200d4090, 0x2c)
	/myGopath/jwt-test/vendor/github.com/robbert229/jwt/algorithms.go:50 +0xff
gitlab.com/jwt-test/vendor/github.com/robbert229/jwt.(*Algorithm).Encode(0xc42000a060, 0xc420090010, 0x110490b, 0x4, 0xc42009e1b8, 0x0)
	/myGopath/jwt-test/vendor/github.com/robbert229/jwt/algorithms.go:76 +0x1e7
main.decode(0xc42000a060, 0xc4200160d0)
	/myGopath/jwt-test/main.go:24 +0xca
created by main.main
	/myGopath/jwt-test/main.go:15 +0xf3
exit status 2

diff --git a/algorithms.go b/algorithms.go
index 745118c..64f2772 100644
--- a/algorithms.go
+++ b/algorithms.go
@@ -143,9 +143,7 @@ func (a *Algorithm) validateSignature(encoded string) error {
                return errors.Wrap(err, "unable to sign token for validation")
        }
 
-       b64SignedAttempt := base64.RawURLEncoding.EncodeToString([]byte(signedAttempt))
-
-       if !hmac.Equal([]byte(b64Signature), []byte(b64SignedAttempt)) {
+       if !hmac.Equal([]byte(b64Signature), []byte(signedAttempt)) {
                return errors.New("invalid signature")
        }