Method validate_eve_jwt

service/esiAccess.py:234–271

Validate a JWT token retrieved from the EVE SSO. Ignores the `aud` claim in token due to avoid unexpected breaking changes to ESI. Args: jwt_token: A JWT token originating from the EVE SSO Returns dict: The contents of the validated J

(self, jwt_token)

        return res

    def validate_eve_jwt(self, jwt_token):
        """Validate a JWT token retrieved from the EVE SSO.

        Ignores the `aud` claim in token due to avoid unexpected breaking
        changes to ESI.

        Args:
            jwt_token: A JWT token originating from the EVE SSO
        Returns
            dict: The contents of the validated JWT token if there are no
                  validation errors
        """

        try:
            jwk_sets = self.jwks["keys"]
        except KeyError as e:
            raise GenericSsoError("Something went wrong when retrieving the JWK set. The returned "
                  "payload did not have the expected key {}. \nPayload returned "
                  "from the SSO looks like: {}".format(e, self.jwks))

        jwk_set = next((item for item in jwk_sets if item["alg"] == "RS256"))

        try:
            return jwt.decode(
                jwt_token,
                jwk_set,
                algorithms=jwk_set["alg"],
                issuer=[self.server_base.sso, "https://%s" % self.server_base.sso],
                # ignore "aud" claim: https://tweetfleet.slack.com/archives/C30KX8UUX/p1648495011905969
                options={"verify_aud": False, "verify_exp": self.settings.get("enforceJwtExpiration")}
            )
        except ExpiredSignatureError as e:
            raise GenericSsoError("The JWT token has expired: {}".format(str(e)))
        except JWTError as e:
            raise GenericSsoError("The JWT signature was invalid: {}".format(str(e)))
        except JWTClaimsError as e:
            raise GenericSsoError("The issuer claim was not from login.eveonline.com or "
                "https://login.eveonline.com: {}".format(str(e)))

    def _before_request(self, ssoChar):
        if ssoChar: