only try to validate after checking if the token is not empty

DataBiosphere · Oct 19, 2023 · 187ca84 · 187ca84
1 parent 9034f09
commit 187ca84
Showing 1 changed file with 4 additions and 5 deletions.
diff --git a/...ice/src/main/java/org/broadinstitute/listener/relay/http/RelayedHttpRequestProcessor.java b/...ice/src/main/java/org/broadinstitute/listener/relay/http/RelayedHttpRequestProcessor.java
@@ -166,13 +166,12 @@ public Result writeSetCookieResponse(RelayedHttpListenerContext context) {
 
     // Get token from request
     var unverifiedAuthToken = Utils.getTokenFromAuthorization(context.getRequest().getHeaders());
-    // Verify the JWT signature
-    JWTVerifier.BaseVerification verifier = (JWTVerifier.BaseVerification);
-    DecodedJWT authToken = verifier.build().verify(unverifiedAuthToken);
-
-    if (authToken.isEmpty()) {
+    if (unverifiedAuthToken.isEmpty()) {
       return Result.FAILURE;
     }
+    // Verify the JWT signature
+    JWTVerifier.BaseVerification verifier = (JWTVerifier.BaseVerification);
+    DecodedJWT authToken = verifier.build().verify(unverifiedAuthToken.toString());
 
     Map<String, String> requestHeaders = context.getRequest().getHeaders();