8000 Unhandled NPE with alg:none JWT in Bearer Authentication by mabartos · Pull Request #48798 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Unhandled NPE with alg:none JWT in Bearer Authentication - #48798

Merged
rmartinc merged 2 commits into
keycloak:mainfrom
mabartos:KC-48744
May 12, 2026
Merged

Unhandled NPE with alg:none JWT in Bearer Authentication#48798
rmartinc merged 2 commits into
keycloak:mainfrom
mabartos:KC-48744

Conversation

@mabartos
@mabartos mabartos commented May 7, 2026
Copy link
Copy Markdown
8000
Member

@mabartos
Unhandled NPE with alg:none JWT in Bearer Authentication
96f2c44 
Closes keycloak#48744

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
@mabartos
mabartos requested a review from a team as a code owner May 7, 2026 13:26
@mabartos
mabartos requested a review from a team May 7, 2026 13:41
@mabartos mabartos self-assigned this May 7, 2026
rmartinc
rmartinc requested changes May 8, 2026
View reviewed changes
@rmartinc rmartinc left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @mabartos! LGTM! Just a minor change for the test. I think that creating a normal none token is better. You can see other tests that are doing this.

Comment thread tests/base/src/test/java/org/keycloak/tests/oauth/TokenInputValidationTest.java Resolved
@mabartos @rmartinc
Update test to create programatically token with alg:none
c420dc9 
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Ricardo Martin <rmartinc@redhat.com>
@mabartos
mabartos requested a review from rmartinc May 11, 2026 14:34
rmartinc
rmartinc approved these changes May 12, 2026
View reviewed changes
@rmartinc rmartinc left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @mabartos! LGTM now!

@rmartinc
rmartinc merged commit 1e99746 into keycloak:main May 12, 2026
86 checks passed
@stianst stianst mentioned this pull request Jun 1, 2026
Closed
sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026
@mabartos @rmartinc @sashyo
Unhandled NPE with alg:none JWT in Bearer Authentication (keycloak#48798
16f86dd 
)

* Unhandled NPE with alg:none JWT in Bearer Authentication

Closes keycloak#48744

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update test to create programatically token with alg:none

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Ricardo Martin <rmartinc@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Ricardo Martin <rmartinc@redhat.com>
@jimmychakkalakal jimmychakkalakal mentioned this pull request Aug 10, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rmartinc rmartinc rmartinc approved these changes

Assignees

@mabartos mabartos

Labels

team/core-clients

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Input validation/ Unhandled NullPointerException on alg:none JWT in Bearer Authentication

2 participants

@mabartos @rmartinc
0