Skip to content

Commit 80daf65

Browse files
NFC-115 Improve unverifiedSigningCertificates check
Signed-off-by: Sander Kondratjev <sander.kondratjev@nortal.com>
1 parent ec1cc76 commit 80daf65

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1Validator.java

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,10 @@ protected String getSupportedFormatPrefix() {
7878

7979
@Override
8080
public X509Certificate validate(WebEidAuthToken token, String currentChallengeNonce) throws AuthTokenException {
81-
if (token.getUnverifiedSigningCertificates() != null) {
82-
throw new AuthTokenParseException("'unverifiedSigningCertificates' field is not allowed for format '" + token.getFormat() + "'");
81+
if (isExactV10Format(token.getFormat()) && token.getUnverifiedSigningCertificates() != null) {
82+
throw new AuthTokenParseException(
83+
"'unverifiedSigningCertificates' field is not allowed for format '" + token.getFormat() + "'"
84+
);
8385
}
8486

8587
if (token.getUnverifiedCertificate() == null || token.getUnverifiedCertificate().isEmpty()) {
@@ -109,4 +111,8 @@ public X509Certificate validate(WebEidAuthToken token, String currentChallengeNo
109111

110112
return subjectCertificate;
111113
}
114+
115+
private static boolean isExactV10Format(String format) {
116+
return V1_SUPPORTED_TOKEN_FORMAT_PREFIX.equals(format) || "web-eid:1.0".equals(format);
117+
}
112118
}

0 commit comments

Comments
 (0)