From e8da1da26b4c1627229a1144fa310673ac2649ef Mon Sep 17 00:00:00 2001 From: Sanan Guliyev Date: Tue, 24 Apr 2018 23:42:19 +0200 Subject: Convert `exp` header to int if it is valid IntDate Some dynamic value generator (for example Paw https://paw.cloud/extensions/JsonWebTokenDynamicValue) generate string value for timestamp and it raises the bad signature error. --- itsdangerous.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/itsdangerous.py b/itsdangerous.py index cdd2329..f618038 100644 --- a/itsdangerous.py +++ b/itsdangerous.py @@ -825,6 +825,11 @@ class TimedJSONWebSignatureSerializer(JSONWebSignatureSerializer): if 'exp' not in header: raise BadSignature('Missing expiry date', payload=payload) + try: + header['exp'] = int(header['exp']) + except ValueError: + raise BadHeader('Expiry date is not valid timestamp', payload=payload) + if not (isinstance(header['exp'], number_types) and header['exp'] > 0): raise BadSignature('expiry date is not an IntDate', -- cgit v1.2.1