Repository navigation
Fix at_hash verification for string access tokens - #339
mehdifanai wants to merge 1 commit into
Conversation
pycognito 2024.5.1 hashes the Cognito access token as a str when verifying an ID token's OIDC at_hash claim, which raises TypeError: Cannot convert str to buffer on Python 3.14. This breaks token-based setup (pasted Google/Apple Cognito tokens) whenever the ID token carries an at_hash claim, which Hosted-UI tokens do. Add pycognito_compat.py, a scoped shim that rebinds only pyemvue.auth.Cognito (not pycognito.Cognito globally) to a subclass whose verify_token fixes the at_hash computation per the still-open NabuCasa/pycognito#339, gated on a runtime probe so it becomes a no-op automatically once pycognito ships that fix. Hook it in at the two places PyEmVue's Cognito client gets constructed: VueHub in config_flow.py and async_login_vue in __init__.py. Reproduced the bug and verified the fix does not weaken verification in tests/test_pycognito_compat.py using a locally generated RS256 JWT/JWKS pair (no network). Documented the decision and flagged the migration plan's future direct-pycognito helper to carry the same fix. Co-authored-by: Sean T. Martinez <Sean@net.secretsquirrel.club> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
|
I hit this same issue with Apple SSO in the Home Assistant Emporia Vue integration: token validation failed with Applying the same string/bytes handling as this PR in a local compatibility adapter resolved it. Fresh Emporia tokens now connect successfully, with all 100+ sensor entities reporting across three Vue monitors. This was tested on Home Assistant 2026.9.4 with pycognito 2024.5.1 and PyJWT 2.13.0. I also prepared six additional regression tests against this PR's branch: valid hashes and decoded claims, mismatched access tokens, bytes access tokens, invalid signatures, ID tokens without @mehdifanai, would you like to include these tests in this PR? I can provide the patch or open a tests-only PR against your fix branch. This PR is still in draft too,what's holding it up. Can I help? |
Summary
at_hashstring claim.at_hashvalues.Root cause
Cognito.verify_tokenpassesself.access_tokendirectly tocompute_hash_digest. Cognito access tokens are strings, while current PyJWThash implementations require bytes. This raises
TypeErrorbefore an ID tokenwith an
at_hashclaim can be verified. After hashing, the Base64URL result isalso bytes and must be decoded before it is compared with the string claim.
The conversion is deliberately conditional so callers that already provide a
bytes-like access token retain their existing hashing path.
This failure was observed through Emporia Vue token authentication on Home
Assistant 2026.7/Python 3.14: magico13/ha-emporia-vue#439
Validation
at_hashcases under Home Assistant'sPython 3.14 runtime