JWT token values not enforced: clear-text config takes precedence over signed JWT payload

[pst]

Bug Report:

Environment: onlyoffice/documentserver:9.4 (Docker), embedded DocsAPI.DocEditor

Issue: According to the Security FAQ, when JWT is enabled the clear-text config should be ignored in favor of the signed JWT payload. However, certain fields (e.g. editorConfig.user.name) are still read from the clear-text config instead of the JWT token – allowing a client to manipulate editor behavior despite JWT enforcement being active.

Otherwise, the integration works correctly – documents load and save without any issues. The JWT token is apparently being validated, as mismatched or invalid signatures correctly result in errors.

Config (test environment – JWT can be checked in https://www.jwt.io/ with secret secretsecretsecretsecretsecretsecret): Note that the clear-text config intentionally contains a different value for editorConfig.user.name than the one signed in the JWT token.

config = {
  "document" : {
    "fileType" : "docx",
    "key" : "19e6ffc3548-e5c9eb5a-7883-4630-b49c-5bee5620c0f2",
    "title" : "/docs/test1",
    "url" : "http://host.docker.internal:8081/designer/api/documents/load/19e6ffc3548-e5c9eb5a-7883-4630-b49c-5bee5620c0f2",
    "permissions" : {
      "edit" : true,
      "review" : true,
      "download" : false,
      "print" : false,
      "copy" : false,
      "fillForms" : true,
      "modifyFilter" : false,
      "modifyContentControl" : false
    }
  },
  "editorConfig" : {
    "callbackUrl" : "http://host.docker.internal:8081/designer/api/documents/save",
    "lang" : "en",
    "mode" : "edit",
    "customization" : {
      "forcesave" : true,
      "autosave" : true,
      "trackChanges" : true,
      "chat" : false,
      "comments" : false,
      "compactToolbar" : false,
      "hideRightMenu" : true,
      "uiTheme" : "theme-light"
    },
    "user" : {
      "id" : "USER-D5AF2B02-3051-4506-B1DF-7CEDC3D9E6E2",
      "name" : "Developer user CHANGED"
    }
  },
  "documentType" : "word",
  "token" : "eyJhbGciOiJIUzI1NiJ9.eyJkb2N1bWVudCI6eyJmaWxlVHlwZSI6ImRvY3giLCJrZXkiOiIxOWU2ZmZjMzU0OC1lNWM5ZWI1YS03ODgzLTQ2MzAtYjQ5Yy01YmVlNTYyMGMwZjIiLCJ0aXRsZSI6Ii9kb2NzL3Rlc3QxIiwidXJsIjoiaHR0cDovL2hvc3QuZG9ja2VyLmludGVybmFsOjgwODEvZGVzaWduZXIvYXBpL2RvY3VtZW50cy9sb2FkLzE5ZTZmZmMzNTQ4LWU1YzllYjVhLTc4ODMtNDYzMC1iNDljLTViZWU1NjIwYzBmMiIsInBlcm1pc3Npb25zIjp7ImVkaXQiOnRydWUsInJldmlldyI6dHJ1ZSwiZG93bmxvYWQiOmZhbHNlLCJwcmludCI6ZmFsc2UsImNvcHkiOmZhbHNlLCJmaWxsRm9ybXMiOnRydWUsIm1vZGlmeUZpbHRlciI6ZmFsc2UsIm1vZGlmeUNvbnRlbnRDb250cm9sIjpmYWxzZX19LCJlZGl0b3JDb25maWciOnsiY2FsbGJhY2tVcmwiOiJodHRwOi8vaG9zdC5kb2NrZXIuaW50ZXJuYWw6ODA4MS9kZXNpZ25lci9hcGkvZG9jdW1lbnRzL3NhdmUiLCJsYW5nIjoiZW4iLCJtb2RlIjoiZWRpdCIsImN1c3RvbWl6YXRpb24iOnsiZm9yY2VzYXZlIjp0cnVlLCJhdXRvc2F2ZSI6dHJ1ZSwidHJhY2tDaGFuZ2VzIjp0cnVlLCJjaGF0IjpmYWxzZSwiY29tbWVudHMiOmZhbHNlLCJjb21wYWN0VG9vbGJhciI6ZmFsc2UsImhpZGVSaWdodE1lbnUiOnRydWUsInVpVGhlbWUiOiJ0aGVtZS1saWdodCJ9LCJ1c2VyIjp7ImlkIjoiVVNFUi1ENUFGMkIwMi0zMDUxLTQ1MDYtQjFERi03Q0VEQzNEOUU2RTIiLCJuYW1lIjoiRGV2ZWxvcGVyIHVzZXIifX0sImRvY3VtZW50VHlwZSI6IndvcmQiLCJpYXQiOjE3Nzk5OTUyNjAsImV4cCI6MTc3OTk5ODg2MH0.UyRwmoLGRMgBZenhbVlNX98p_R061mtlyUjiN30Pi9U"
};

docEditor = new DocsAPI.DocEditor("placeholder", config);

[Constantine]

Hello @pst

@pst

Issue: According to the Security FAQ, when JWT is enabled the clear-text config should be ignored in favor of the signed JWT payload.

There is no such definition in the FAQ. It specifically states “corresponding data”, which in fact is correct, please refer to this page of Signature section: Security | ONLYOFFICE

[pst]

Hi @Constantine ,

I was already referring to this exact page. The link you mention is the same, that I sent in my posting. On this page it says:

”ONLYOFFICE Docs validates the token. If it is valid, the data from the payload is used instead of the corresponding data from the main parameters.”

The payload contains the full editor configuration, so there is corresponding data for every field.

[Constantine]

Indeed, my bad, please refer to the list here: Browser | ONLYOFFICE

[pst]

Oh I understand, so only certain fields will be validated (taken from the signed payload). Still wondering why not all fields are taken from the signed payload, but perhaps it has deeper technical reasons.

Thank you for the clarification!

[Constantine]

@pst

Still wondering why not all fields are taken from the signed payload, but perhaps it has deeper technical reasons.

Not at all, only listed parameters are validated, if presented, because they affect what editor should allow to a user and with which document. For instance, document.key is necessary to identify the document among other docs, document.permissions block sets what user can and cannot do in the editor, etc. Generally speaking, these are ground rules for the editor.

I hope it makes sense.