Skip to content

refactor(auth): JWT ライブラリを python-jose から PyJWT へ移行し ecdsa 脆弱性を解消#481

Merged
yusuke0610 merged 1 commit into
mainfrom
refactor/replace-python-jose-with-pyjwt
Jul 8, 2026
Merged

refactor(auth): JWT ライブラリを python-jose から PyJWT へ移行し ecdsa 脆弱性を解消#481
yusuke0610 merged 1 commit into
mainfrom
refactor/replace-python-jose-with-pyjwt

Conversation

@yusuke0610

@yusuke0610 yusuke0610 commented Jul 8, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Owner

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

  • auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
  • requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
  • THIRD_PARTY_LICENSES.md を make licenses で再生成
  • README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

  • pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
  • auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
  • make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores

    • Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
    • Refreshed related dependency and license listings to match the current setup.

  • Documentation

    • Aligned the README and internal guidance with the updated authentication stack.

@yusuke0610 @claude
refactor(auth): JWT ライブラリを python-jose から PyJWT へ移行し ecdsa 脆弱性を解消
a42100c 
python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性
(PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が
全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで
cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto]
へ移行して ecdsa 依存自体を除去する。

- auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
- requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
- THIRD_PARTY_LICENSES.md を make licenses で再生成
- README / auth-security.md の JWT ライブラリ表記を更新

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions github-actions Bot added auth refactor リファクタリング documentation Improvements or additions to documentation backend バックエンド test テスト追加・修正 labels Jul 8, 2026
@coderabbitai

coderabbitai Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)
  • .claude/rules/backend/auth-security.md
  • README.md
  • THIRD_PARTY_LICENSES.md
  • backend/app/core/security/auth.py
  • backend/requirements.txt
  • backend/tests/auth/test_token_manager.py
📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s) Summary
Core auth logic switched to PyJWT
backend/app/core/security/auth.py		 Import changed from jose's jwt to direct import jwt; exception handling updated from JWTError to jwt.PyJWTError in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import
backend/tests/auth/test_token_manager.py		 JWT import switched from from jose import jwt to import jwt, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates
backend/requirements.txt, README.md, THIRD_PARTY_LICENSES.md, .claude/rules/backend/auth-security.md		 python-jose[cryptography] replaced with PyJWT[crypto]==2.13.0 in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@yusuke0610
yusuke0610 merged commit f0917a7 into main Jul 8, 2026
24 checks passed
@yusuke0610
yusuke0610 deleted the refactor/replace-python-jose-with-pyjwt branch July 20, 2026 12:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

auth backend バックエンド documentation Improvements or additions to documentation refactor リファクタリング test テスト追加・修正

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yusuke0610