P1 auth: replace python-jose with pyjwt (CVE-2024-33663/33664) #48

Activity

1. SlavaKuntsov

   added

   phase:backlogBacklogBacklog

   area:autharea:autharea:auth

   phase:16Phase 16 security hotfix: CRITICAL chain + CVEPhase 16 security hotfix: CRITICAL chain + CVE

   and removed

   phase:backlogBacklogBacklog

   on Sep 13, 2026
2. SlavaKuntsov

   self-assigned this

   on Sep 14, 2026
3. SlavaKuntsov commented on Sep 18, 2026

   

   SlavaKuntsov

   on Sep 18, 2026

   OwnerAuthor

   More actions

   Ready for review — Phase 16

   Implemented (#48)

   • python-jose → PyJWT 2.14 (HS256, options={"require": ["exp","sub"]}), passlib → argon2-cffi (PasswordHasher)
   • Лимит размера токена (8 KB) до decode — JWT-бомба CVE-2024-33664
   • Обновлены pyproject.toml, uv.lock, тесты (+ oversized/no-exp регрессии), docs/spec.md

   Verification

   • make test-py — 38 passed (18 auth + 20 transcoder)
   • make lint-py — black/flake8/mypy чисто
   • Независимое ревью фазы: 1 итерация, blockers исправлены

   Commits: d1314df (+ cf78449 fixes). PR закроет тикет через Closes #48.
4. SlavaKuntsov commented on Sep 18, 2026

   

   SlavaKuntsov

   on Sep 18, 2026

   OwnerAuthor

   More actions

   Pull request opened

   #77 — will auto-close via Closes #48 on merge.

   Project status: In review (synced).

   Verification

   • make test-py / make test-go — pass
   • make lint-py / make lint-go / make lint-front — чисто
   • make up && make e2e — PASS на чистых volumes

   Remaining risks

   none known (follow-up: #76)
5. SlavaKuntsov

   closed this as completedin #77on Sep 18, 2026