JWT claims used before validation

Code reviewCode quality & reviewMid–Senior~18 min

Review this Go JWT middleware.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 18 min

Mark a line and say what kind of problem it is.0 findings

1func Authenticate(next http.Handler) http.Handler {

2 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

3 raw := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")

4 tok, err := jwt.Parse(raw, func(t *jwt.Token) (interface{}, error) {

5 if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {

6 return nil, errors.New("bad alg")

7 }

8 return hmacKey, nil

9 })

10 claims := tok.Claims.(jwt.MapClaims)

11 r = r.WithContext(context.WithValue(r.Context(), userKey, claims["sub"]))

12 next.ServeHTTP(w, r)

13 })

14}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.