fix(security): enable cookie secure flag, fix redos, add jwt decode warn by omercnet · Pull Request #781 · descope/python-sdk

omercnet · 2026-03-12T06:06:43Z

Fixes descope/etc#14526

View workflow run

Excellent! All security fixes have been successfully committed. Let me create a summary of the changes:

Security Fixes Completed ✅

CRITICAL Issues Fixed

Flask Cookie Secure Flag (descope/flask/__init__.py:37)
- Fixed: Changed secure=False to secure=True
- Impact: Session and refresh tokens now require HTTPS, preventing man-in-the-middle session hijacking
- CVSS: 8.1 → Resolved
ReDoS Vulnerability in Phone Regex (descope/common.py:11)
- Fixed: Replaced catastrophic backtracking regex with simple bounded pattern ^[\d\s\-\+\.#xX]{7,25}$
- Impact: Prevents CPU exhaustion DoS attacks via crafted phone numbers
- CVSS: 7.5 → Resolved
- Related: Code scanning alert #2914

HIGH Severity Issues Fixed

JWT Decode Without Verification (descope/jwt_common.py:69-82)
- Fixed: Added DeprecationWarning to decode_token_unverified()
- Impact: Developers are now warned when using unverified token decoding
- Warning Message: "Do not use this for authentication or authorization. Use proper token validation with signature verification instead."
TLS Certificate Bypass (skip_verify) (descope/descope_client.py:31)
- Fixed: Added loud SecurityWarning when skip_verify=True is used
- Impact: Alerts developers to dangerous TLS bypass in production
- Warning Message: "⚠️ SECURITY WARNING: TLS certificate verification is DISABLED... NEVER use skip_verify=True in production environments."
- Sample Files: Added clear comments in both sample apps explaining this is for local dev only

What Was Preserved (As Requested)

✅ skip_verify parameter kept for local development

Parameter remains functional for developers using self-signed certificates
Now emits clear runtime warnings
Sample code includes security comments
Acceptable for local dev, warned against for production

Files Changed

descope/flask/__init__.py - Secure cookie flag
descope/common.py - Phone regex ReDoS fix
descope/jwt_common.py - JWT unverified decode warning
descope/descope_client.py - TLS bypass warning
samples/otp_web_sample_app.py - Security comment
samples/password_web_sample_app.py - Security comment

All changes have been committed and are ready for review! 🐕

Created by Shuni 🐕

Security fixes addressing March 2026 security review findings: CRITICAL fixes: - Flask cookies now enforce secure=True flag (prevents session hijacking over HTTP) - Replace ReDoS-vulnerable phone regex with simpler bounded pattern (prevents DoS) HIGH severity fixes: - Add deprecation warning to decode_token_unverified() (prevents misuse for auth) - Add SecurityWarning when skip_verify=True is used (alerts TLS bypass) - Document skip_verify in samples as local-dev-only (prevents production misuse) The skip_verify parameter is intentionally kept for local development with self-signed certificates, but now emits clear warnings to prevent production use. Fixes: Related to code scanning alert #2914 (phone regex) Co-authored-by: Shuni <251468265+shuni-bot[bot]@users.noreply.github.com>

Copilot

Pull request overview

Security-focused PR that addresses multiple vulnerabilities: enabling HTTPS-only cookies in the Flask integration, fixing a ReDoS vulnerability in phone number validation, and adding runtime warnings for insecure JWT decoding and TLS verification bypass.

Changes:

Hardened cookie security (secure=True) and added runtime SecurityWarning for TLS bypass (skip_verify=True)
Replaced a phone validation regex susceptible to catastrophic backtracking with a simpler bounded character-class pattern
Added a deprecation warning to decode_token_unverified() and security comments in sample apps

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
descope/flask/init.py	Changed `secure=False` to `secure=True` for session cookies
descope/common.py	Replaced ReDoS-vulnerable phone regex with simple character-class pattern
descope/jwt_common.py	Added `warnings.warn` to `decode_token_unverified()`
descope/descope_client.py	Added `SecurityWarning` when `skip_verify=True` is used
samples/otp_web_sample_app.py	Added security comment about `skip_verify` usage
samples/password_web_sample_app.py	Added security comment about `skip_verify` usage

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

descope/jwt_common.py

descope/common.py

… category

…_garbage

github-actions · 2026-03-12T07:53:59Z

Coverage report

The coverage rate went from 98.37% to 98.34% ⬇️

83.33% of new lines are covered.

Diff Coverage details (click to unfold)

descope/jwt_common.py

100% of new lines are covered (98.03% of the complete file).

descope/common.py

100% of new lines are covered (99.12% of the complete file).

descope/descope_client.py

66.66% of new lines are covered (97.4% of the complete file).
Missing lines: 56

dorsha

Check comments.

dorsha · 2026-03-12T09:33:56Z

descope/flask/__init__.py

        path=cookie_data.get("path", "/"),
        domain=cookie_domain,
-        secure=False,  # True
+        secure=True,  # Cookies must be sent over HTTPS only


@omercnet can't this break compatibility?

maybe only for local development, not prod

dorsha · 2026-03-12T09:34:03Z

descope/common.py

+# Simple phone validation to prevent ReDoS (catastrophic backtracking)
+# Optional leading +, then digits, spaces, hyphens, parentheses, dots, # for extension
+# Requires at least 4 consecutive digits, length 7-25, at most one leading +
+PHONE_REGEX = r"""^(?=.*\d{4,})\+?[\d\s\-\(\)\.#xX]{6,24}$"""


@omercnet can't this break compatibility?

it's more relaxed regex but still works, tests validate it

dorsha

Approved, consider releasing it with feat or with !.

Copilot AI review requested due to automatic review settings March 12, 2026 06:06

Copilot started reviewing on behalf of omercnet March 12, 2026 06:07 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

descope/jwt_common.py Outdated Show resolved Hide resolved

descope/common.py Outdated Show resolved Hide resolved

omercnet added 4 commits March 12, 2026 07:07

fix: address review feedback - phone regex lookahead, SecurityWarning…

b9d28ca

… category

fix: phone regex - restrict to single leading +, reject ++prefix

2b189fe

fix: suppress SecurityWarning in test_decode_token_unverified_handles…

49736ac

…_garbage

fix: SecurityWarning does not exist in Python - use UserWarning

a4360af

omercnet requested review from LioriE, aviadl and dorsha March 12, 2026 09:27

dorsha reviewed Mar 12, 2026

View reviewed changes

dorsha approved these changes Mar 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): enable cookie secure flag, fix redos, add jwt decode warn#781

fix(security): enable cookie secure flag, fix redos, add jwt decode warn#781
omercnet wants to merge 5 commits intomainfrom
shuni/task-20260312060310

omercnet commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 12, 2026

descope/jwt_common.py

descope/common.py

descope/descope_client.py

Uh oh!

dorsha left a comment

Uh oh!

dorsha Mar 12, 2026

Uh oh!

omercnet Mar 12, 2026

Uh oh!

dorsha Mar 12, 2026

Uh oh!

omercnet Mar 12, 2026

Uh oh!

dorsha left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

omercnet commented Mar 12, 2026

Security Fixes Completed ✅

CRITICAL Issues Fixed

HIGH Severity Issues Fixed

What Was Preserved (As Requested)

Files Changed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 12, 2026

Coverage report

descope/jwt_common.py

descope/common.py

descope/descope_client.py

Uh oh!

dorsha left a comment

Choose a reason for hiding this comment

Uh oh!

dorsha Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

omercnet Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

dorsha Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

omercnet Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

dorsha left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants