From 6ec24c8bb3f458cec70b05f44f3e2abdcfde1158 Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Tue, 25 Aug 2026 08:35:24 +0800 Subject: [PATCH] =?UTF-8?q?fix(oidc):=20userinfo=20=E8=A7=A3=E7=A0=81?= =?UTF-8?q?=E5=85=B3=E9=97=AD=20verify=5Faud=EF=BC=8C=E4=BF=AE=E5=A4=8D=20?= =?UTF-8?q?Gitea=20SSO=20401?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - pyjwt>=2.13 在 decode 未传 audience 时，payload 含 aud 必抛 InvalidAudienceError - /oidc/userinfo 改用 options={'verify_aud': False}，aud 归属仍由 _ClientIds() 手动校验，安全等价 --- gvsds/apps/gerp/oidc.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/gvsds/apps/gerp/oidc.py b/gvsds/apps/gerp/oidc.py index af8e6163..db645287 100644 --- a/gvsds/apps/gerp/oidc.py +++ b/gvsds/apps/gerp/oidc.py @@ -463,7 +463,9 @@ class OIDCUserInfoView(APIView): return Response({'error': 'invalid_token'}, status=401) token = auth[7:] try: - payload = jwt.decode(token, _GetPrivateKey().public_key(), algorithms=['RS256']) + # verify_aud 关闭：pyjwt>=2.13 未传 audience 时 payload 含 aud 必抛 InvalidAudienceError； + # aud 归属由下方 _ClientIds() 手动校验 + payload = jwt.decode(token, _GetPrivateKey().public_key(), algorithms=['RS256'], options={'verify_aud': False}) except jwt.PyJWTError as e: logger.warning('[OIDC] userinfo token 校验失败: %s', e) return Response({'error': 'invalid_token'}, status=401)