server/auth: fix panic a malformed jwt generation and add test-cases

[ArkaSaha30]

This PR is to fix panic on identical JWT token generation and authentication as well as add test cases for the same.

Extension of #15002

Fixes: #14931

[ahrtr]

Thanks @ArkaSaha30 . Please take this as a high priority, because it's planned to be included in 3.5.8.

[ArkaSaha30]

Hi @ahrtr , just wanted to confirm if I need to create public.pem private.pem in ./tests/fixtures/ as a part of adding the test case?

[ahrtr]

Hi @ahrtr , just wanted to confirm if I need to create public.pem private.pem in ./tests/fixtures/ as a part of adding the test case?

Can you reuse the existing certificate and key files? Please refer to server/auth/jwt_test.go.

[ArkaSaha30]

In server/auth/jwt_test.go will it be an addition to the map object in TestJWTInfo(). I am not sure what exact unit test case should be written around the change

[ahrtr]

You need to intentionally generate a JWT token without username or revision field, then call (*tokenJWT) info() with the token, you should get nil, false

[ahrtr]

@ArkaSaha30 Please remove WIP from the title once you finish this PR, and then I will take a look at this PR soon.

[serathius]

This PR is blocking v3.5.8 release, please provide fixes as fast you can. Plan is to release next week, so please provide fixes till Monday or we will need to finish the PR. Sorry for not making clear earlier.

[ahrtr]

This PR is blocking v3.5.8 release, please provide fixes as fast you can. Plan is to release next week, so please provide fixes till Monday or we will need to finish the PR. Sorry for not making the importance the PR earlier.

I will work with @ArkaSaha30 to get it done next Monday. See also #15585 (comment)

[ArkaSaha30]

I'm already working on it, I will push the changes for review ASAP.

[ahrtr]

@ArkaSaha30 Please follow #15676

[ahrtr]

Usually we fix issue on main branch firstly, and then backport to 3.5 and 3.4. But we have no time to wait, because we need to release both 3.5.8 and 3.4.25 soon to resolve some CVEs. So I delivered two PRs myself for both 3.5 and 3.4 before this one is approved/merged. Sorry for the confusion.

Anyway, please follow the same way to update this PR.

[ArkaSaha30]

Thank you @ahrtr, I am updating this PR accordingly.

[jmhbnz]

LGTM. Thanks @ArkaSaha30.

[ahrtr]

minor comment: please consider to squash the second and third commits.

[ahrtr]

LGTM

[ahrtr]

cc @mitake @spzala PTAL, this should be safe change.

[mitake]

LGTM, thanks @ArkaSaha30 !