Normalize App ID to String & Enhance JWT Issuer Verification (#3272)
This PR fixes PyGithub/PyGithub#3214 by ensuring self._app_id is always a string in AppAuth, preventing type mismatches in the JWT "iss" claim. It also strengthens JWT tests by adding issuer validation during decoding. The AppAuth class previously stored self._app_id as-is (either int or str, per Union[int, str]), which could result in the JWT "iss" claim being an integer. Per the JWT specification ([RFC 7519, Section 4.1.1](https://tools.ietf.org/html/rfc7519#section-4.1.1)), the iss (issuer) claim should be a string, and GitHub’s authentication flow expects it as such. This type mismatch caused potential failures in downstream processing or validation (e.g., with PyJWT or GitHub’s API), as reported in #3214. Additionally, the tests lacked proactive issuer checks, relying only on payload comparison, which missed an opportunity to catch errors earlier. **Changes** - String Normalization in AppAuth (github/Auth.py): `Changed self._app_id = app_id to self._app_id = str(app_id)` in the initializer. This ensures the "iss" claim is consistently a string, regardless of whether the input app_id is an integer (common for GitHub App IDs) or a string. - Test Improvements (tests/Authentication.py): Updated testCreateJWT and testCreateJWTWithExpiration to expect a string "iss" and added `issuer=str(APP_ID)` to jwt.decode(). This leverages PyJWT’s built-in issuer validation (introduced in PyJWT 1.0.0+), aligning with its security features and failing fast on issuer mismatches. **Fixes** ✅ Fixes type mismatch in JWT "iss" claim. ✅ Enhances test robustness by failing early on incorrect issuers. **Impact** Fixes the root cause of type-related errors in JWT generation, ensuring compliance with RFC 7519 and GitHub’s expectations. Strengthens tests by mirroring real-world validation (e.g., GitHub rejecting tokens with invalid iss), reducing the risk of regressions. **Testing** Verified with pytest tests/Authentication.py—both testCreateJWT and testCreateJWTWithExpiration pass with the updated expectations and issuer verification. Fixes: [PyGithub/PyGithub#3214](https://github.com/PyGithub/PyGithub/issues/3214) --------- Co-authored-by: Enrico Minack <github@enrico.minack.dev>
S
Soubhik Kumar Mitra committed
01196d67452e726a1ef6a26312e50e428b6a705d
Parent: c7858c8
Committed by GitHub <noreply@github.com>
on 7/30/2025, 9:19:02 PM