Skip to content

[security] SDK hardening: distinct unverified status, payload binding #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
beonde merged 2 commits into from
Apr 23, 2026
Merged

[security] SDK hardening: distinct unverified status, payload binding #55

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
884a237
[security] SDK Python hardening: distinct unverified status, payload …
beonde Apr 22, 2026
3cecdb9
fix: use structural comparison for payload binding, remove unused jso…
beonde Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 18 additions & 6 deletions capiscio_sdk/validators/signature.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,15 +98,27 @@ def validate_signature(
import jwt

# Verify signature
jwt.decode(
decoded = jwt.decode(
signature,
public_key,
algorithms=['RS256', 'ES256', 'PS256'],
options={"verify_signature": True}
)

# Signature is valid
logger.debug("Signature verified successfully")
# Bind: compare decoded payload against caller-supplied payload
if decoded != payload:
issues.append(
ValidationIssue(
severity=ValidationSeverity.ERROR,
code="PAYLOAD_MISMATCH",
message="Decoded signature payload does not match the supplied payload",
path="signatures",
)
)
score = 0
else:
# Signature is valid and payload matches
logger.debug("Signature verified successfully")

except jwt.InvalidSignatureError:
issues.append(
Expand Down Expand Up @@ -156,12 +168,12 @@ def validate_signature(
issues.append(
ValidationIssue(
severity=ValidationSeverity.WARNING,
code="NO_PUBLIC_KEY",
message="Signature format valid but no public key provided for verification",
code="UNVERIFIED_FORMAT_OK",
message="Signature format valid but cryptographic verification not performed (no public key provided)",
path="signatures",
)
)
Comment on lines +171 to 175
Comment on lines +171 to 175
score = 70 # Format is OK but not verified
score = 50 # Format-only: below success threshold
Comment on lines +172 to +176

# Ensure score doesn't go negative
score = max(0, score)
Expand Down
Loading