vigneshio opened a new pull request, #4753: URL: https://github.com/apache/polaris/pull/4753
## Problem `JWTBroker` sets the issuer claim to `"polaris"` when generating access tokens, but the verification path did not check the issuer claim. A JWT signed with the same realm key but carrying any other issuer would be accepted as a valid Polaris access token. ## Change Add `.withIssuer(ISSUER_KEY)` to the `JWTVerifier` in `JWTBroker.verifyInternal()`, so the issuer claim is validated on every token verification. ## Tests Added `RSAKeyPairJWTBrokerTest.testVerifyRejectsTokenWithWrongIssuer()` to verify that a token signed with the same RSA key but with issuer `"not-polaris"` is rejected with `NotAuthorizedException`. ## Checklist - [x] Clearly explained why the changes are needed - [x] Added/updated tests with good coverage - [x] Updated `CHANGELOG.md` - [ ] Updated documentation in `site/content/in-dev/unreleased` (not needed — no user-facing behavior change) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
