[Backend] Add iss/aud claims to JWT payload type, issuance, and verification #1097 - #1161
Open
abimbolaalabi wants to merge 2 commits into
Open
[Backend] Add iss/aud claims to JWT payload type, issuance, and verification #1097#1161abimbolaalabi wants to merge 2 commits into
abimbolaalabi wants to merge 2 commits into
Conversation
…fication - Added iss and aud fields to SEP10TokenPayload in auth.types.ts - Included iss/aud in token issuance at verifyChallenge - Verified iss/aud in verifyJwt, rejecting mismatches - Added tests for wrong audience and wrong issuer rejection - Updated existing tests to include iss/aud in payloads Closes LabsCrypt#1097
Root causes and fixes:
1. **JWT iss/aud validation caused 401 in integration tests**
- Updated events-list.test.ts and sse-subscribe.test.ts to include
iss/aud in signJwt payloads (matching new verifyJwt requirements)
2. **TypeScript compilation errors (18 errors)**
- indexer-state.ts: used generated Prisma IndexerState type instead
of manual interface missing createdAt
- admin-rate-limiter.middleware.ts: added optional chaining for
forwarded.split result
- soroban-indexer.service.ts: fixed startTime type by using
readString instead of raw field access; removed unused variable
- soroban-event-worker.ts: fixed BigInt/number subtraction by
converting timestamp to BigInt before operation; fixed
totalPausedDuration type by converting result back to Number
- events-wire-format.test.ts: added nullish coalescing for
HANDLER_READ_FIELDS lookup
- stream.test.ts: changed startTime/lastUpdateTime values from
number to bigint literals to match Prisma generated types
- stream.validator.test.ts: added non-null assertion for
result.error.issues access
Verification:
- npm run build (tsc): 0 errors
- auth-jwt.test.ts: 9/9 passed
- auth.middleware.test.ts: 2/2 passed
- auth.test.ts: 16/16 passed
- events-list.test.ts: 7/7 passed
- sse-subscribe.test.ts: 2/2 passed
Closes LabsCrypt#1097
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR adds issuer (iss) and audience (aud) claims to the SEP-10 JWT payload, ensuring tokens are bound to a specific issuer and audience. This prevents token replay across services sharing the same signing secret by adding defense-in-depth validation on verification.
Related Issue
Closes #1097
Changes
\
[MODIFY] backend/src/types/auth.types.ts
Added iss: string and aud: string fields to SEP10TokenPayload interface.
\\
\
[MODIFY] backend/src/middleware/auth.ts
Added JWT_ISSUER and JWT_AUDIENCE constants (configurable via env vars, defaults to 'flowfi-api').
Included iss and aud in token payload during issuance in verifyChallenge.
Added iss/aud validation in verifyJwt, rejecting tokens with mismatched claims.
\\
\
[MODIFY] backend/tests/auth-jwt.test.ts
Added tests for tokens with wrong audience and wrong issuer being rejected.
Updated existing token payloads to include iss/aud.
\\
Verification Results
\
npx vitest run tests/auth-jwt.test.ts tests/auth.middleware.test.ts
✅ 11/11 passed
\\
Acceptance Criteria