validation breaks if x5c array is empty

[ghost]

lua-resty-openidc/lib/resty/openidc.lua

Line 917 in 8c75bc1

if jwk.x5c then

Could we get and #jwk.x5c > 0 added here? Token validation breaks if the array is empty and it's referenced as a TODO in two spots.
It doesn't look like public contributions are enabled on this repo..

[bodewig]

My interpretation of RFC 7517 is the x5c array must contain at least one element for the JWKS to be valid. The claim itself is optional but to me an empty array is different from a claim not being present. I'd recommend you contact your vendor.

At least I don't recall putting in the TODOs. :-)

Of course we could make the parser more lenient, issue a warning here and treat the JWK as if the x5c claim was missing.

Not sure what you mean with "public contributions enabled". Obviously it is possible to create issues and pull requests are supported as well. Is there anything specific you are missing?

[bodewig]

fixed in master branch