-
Notifications
You must be signed in to change notification settings - Fork 200
Fix Plex JWT signature verification #1577
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Fix Plex JWT signature verification #1577
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR hardens Plex JWT handling in MyPlexJWTLogin to support key rotation and avoid failures when Plex publishes multiple signing keys, and adds coverage for the JWT login flow.
Changes:
- Refactors Plex JWT decoding to iterate over all public JWKs returned by Plex, trying each key until one verifies the JWT, and optionally allows decoding without signature verification.
- Adjusts
_getPlexPublicJWKand the internal_queryhelper to better handle JSON responses (including empty bodies) and updated thedecodedJWTproperty to expose a non-verifying decode view. - Adds an integration-style test for
MyPlexJWTLogincovering keypair generation, device registration, JWT refresh, verification, and re-instantiation from an existing token.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| plexapi/myplex.py | Updates MyPlexJWTLogin’s JWT decode/verify logic to loop over all Plex JWKs, tweaks error handling, and makes _query more robust to empty JSON responses. |
| tests/test_myplex.py | Imports MyPlexAccount/MyPlexJWTLogin and adds test_myplex_jwt_login to exercise the JWT login, refresh, and verification workflow end-to-end. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Description
Plex rotates JWKs used for signing the JWTs. Previously only the first JWK was checked for JWT signature verification resulting in an exception if a different JWK was used. Now all JWKs are checked before raising an exception.
Type of change
Please delete options that are not relevant.
Checklist: