Validate Model Target JWT signatures

docs/source/differences-to-vws.rst

@@ -174,8 +174,9 @@ successful in-process Model Target datasets include a Vuforia-shaped
 ``warning`` object after processing completes. This configuration is not
 supported by the Flask/Docker backend.
 Model Target API routes require a three-part JSON Web Token with JSON object
-header and payload parts and a non-``none`` ``alg`` value, such as the token
-returned by the mock OAuth2 route.
+header and payload parts, a non-``none`` ``alg`` value, and a non-empty
+base64url-encoded signature, such as the token returned by the mock OAuth2
+route.
 The mock does not verify token signatures, payload claims such as expiry, or
 token revocation.
 

newsfragments/model-target-jwt-signature.change

@@ -0,0 +1 @@
+Reject Model Target bearer tokens with empty or malformed JWT signatures.

src/mock_vws/_model_target_web_api.py

@@ -176,6 +176,28 @@ def _jwt_payload_error(*, bearer_token: str) -> str | None:
     return None
 
 
+@beartype
+def _jwt_signature_error(*, bearer_token: str) -> str | None:
+    """Return the Vuforia error for an invalid JSON Web Token
+    signature.
+    """
+    encoded_signature = bearer_token.rpartition(".")[2]
+    if not encoded_signature:
+        return "The signature must not be empty"
+
+    try:
+        padding = "=" * (-len(encoded_signature) % 4)
+        base64.b64decode(
+            s=encoded_signature + padding,
+            altchars=b"-_",
+            validate=True,
+        )
+    except ValueError:
+        return "Signed JWT rejected: Invalid signature"
+
+    return None
+
+
 @beartype
 def _require_bearer_token(request: RequestData) -> _ResponseType | None:
     """Return an error response if the request has no bearer token."""
@@ -205,21 +227,16 @@ def _require_bearer_token(request: RequestData) -> _ResponseType | None:
             target="jwt",
             details=None,
         )
-    jwt_header_error = _jwt_header_error(bearer_token=bearer_token)
-    if jwt_header_error is not None:
-        return _error_response(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            code="401",
-            message=jwt_header_error,
-            target="jwt",
-            details=None,
-        )
-    jwt_payload_error = _jwt_payload_error(bearer_token=bearer_token)
-    if jwt_payload_error is not None:
+    jwt_error = _jwt_header_error(bearer_token=bearer_token)
+    if jwt_error is None:
+        jwt_error = _jwt_payload_error(bearer_token=bearer_token)
+    if jwt_error is None:
+        jwt_error = _jwt_signature_error(bearer_token=bearer_token)
+    if jwt_error is not None:
         return _error_response(
             status_code=HTTPStatus.UNAUTHORIZED,
             code="401",
-            message=jwt_payload_error,
+            message=jwt_error,
             target="jwt",
             details=None,
         )

tests/mock_vws/test_model_target_generation_failure.py

@@ -10,7 +10,7 @@
 
 from mock_vws import MockVWS, ModelTargetGenerationFailure
 
-_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.signature"
+_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.c2lnbmF0dXJl"
 _CREATE_URL = "https://vws.vuforia.com/modeltargets/datasets"
 _REQUEST_BODY: dict[str, Any] = {
     "name": "dataset-name",

tests/mock_vws/test_model_target_generation_warning.py

@@ -14,7 +14,7 @@
     ModelTargetGenerationWarning,
 )
 
-_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.signature"
+_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.c2lnbmF0dXJl"
 _CREATE_URL = "https://vws.vuforia.com/modeltargets/datasets"
 _REQUEST_BODY: dict[str, Any] = {
     "name": "dataset-name",

tests/mock_vws/test_model_target_web_api.py

@@ -19,7 +19,7 @@
 
 _VWS_HOST = "https://vws.vuforia.com"
 _DATASET_UUID = "0b12466eee5d49409a440927006ff5d8"
-_MOCK_BEARER_TOKEN = "eyJhbGciOiJtb2NrIn0.e30.signature"
+_MOCK_BEARER_TOKEN = "eyJhbGciOiJtb2NrIn0.e30.c2lnbmF0dXJl"
 
 
 def _dataset_request(*, cad_data_url: str) -> dict[str, Any]:
@@ -271,6 +271,16 @@ def test_missing_bearer_token(
                 "Payload of JWS object is not a valid JSON object",
                 id="payload-not-json-object",
             ),
+            pytest.param(
+                "Bearer eyJhbGciOiJSUzI1NiJ9.e30.",
+                "The signature must not be empty",
+                id="blank-signature",
+            ),
+            pytest.param(
+                "Bearer eyJhbGciOiJSUzI1NiJ9.e30.%",
+                "Signed JWT rejected: Invalid signature",
+                id="signature-not-base64",
+            ),
         ],
     )
     def test_invalid_bearer_token(

tests/mock_vws/test_requests_mock_usage.py

@@ -44,7 +44,7 @@
     processing_time_seconds,
 )
 
-_MODEL_TARGET_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.signature"
+_MODEL_TARGET_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.c2lnbmF0dXJl"
 _MODEL_TARGET_DATASET_REQUEST = {
     "name": "dataset-name",
     "targetSdk": "10.18",

tests/mock_vws/test_respx_mock_usage.py

@@ -19,7 +19,7 @@
 from mock_vws.image_matchers import ExactMatcher
 from mock_vws.target import VuMarkTarget
 
-_MODEL_TARGET_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.signature"
+_MODEL_TARGET_AUTHORIZATION = "Bearer eyJhbGciOiJtb2NrIn0.e30.c2lnbmF0dXJl"
 _MODEL_TARGET_DATASET_REQUEST = {
     "name": "dataset-name",
     "targetSdk": "10.18",