wiomoc/mosquitto-jwt-auth

Mosquitto crashes when attempting login with jwt in username

stefanfoulis opened this issue · 1 comments

I've experienced mosquitto crashing when I try to login without a password and use the jwt as username.

Being able to login in this way is useful when all we want to give the clients is a single "api-key".

I experienced this with the paho library (on python). I've not tried any other libraries yet.
https://www.eclipse.org/paho/clients/python/docs/#username-pw-set

If it does not turn out to be obvious where the error is happening, I can try to make an easier to reproduce example.

Good catch! If the username or password is not set, mosquitto simply passes a null pointer that was not handled correctly.

With the fix a empty username is supported with auth_opt_jwt_validate_sub_match_username : false.
A empty password will show an error but won't crash anymore.