[Backend] Add iss/aud claims to JWT payload type, issuance, and verification #1097 - #1161
Open
abimbolaalabi wants to merge 4 commits into
Open
[Backend] Add iss/aud claims to JWT payload type, issuance, and verification #1097#1161abimbolaalabi wants to merge 4 commits into
abimbolaalabi wants to merge 4 commits into
Conversation
…fication - Added iss and aud fields to SEP10TokenPayload in auth.types.ts - Included iss/aud in token issuance at verifyChallenge - Verified iss/aud in verifyJwt, rejecting mismatches - Added tests for wrong audience and wrong issuer rejection - Updated existing tests to include iss/aud in payloads Closes LabsCrypt#1097
…x schema duplicate Rebuild of the JWT iss/aud feature cleanly on current main: - SEP10TokenPayload gains iss/aud; verifyJwt rejects mismatches; verifyChallenge issues them - events-list and sse-subscribe integration tests sign tokens with iss/aud - Remove duplicate @@unique([transactionHash, eventType]) in schema.prisma (P1012 blocker)
- indexer-state: drop nonexistent createdAt from IndexerStateRow - health.routes: import isRedisAvailable/checkRpcHealth; fix indexerDegraded typo - soroban-indexer: stringify startTime for BigInt; remove unused timestampBigInt - soroban-event-worker: remove unused randomUUID/workerId/requestContext; coerce pausedAt for duration calc - admin-rate-limiter: guard undefined split result - tests: use bigint for streamId/startTime/lastUpdateTime; fix undefined array/object access - stream.controller.test: restore TestRequest type
…ream IDs and new event handlers
abimbolaalabi
force-pushed
the
fix/issue-1097-jwt-iss-aud-claims
branch
from
August 1, 2026 13:28
06cdc0b to
ae081ea
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR adds issuer (iss) and audience (aud) claims to the SEP-10 JWT payload, ensuring tokens are bound to a specific issuer and audience. This prevents token replay across services sharing the same signing secret by adding defense-in-depth validation on verification.
Related Issue
Closes #1097
Changes
\
[MODIFY] backend/src/types/auth.types.ts
Added iss: string and aud: string fields to SEP10TokenPayload interface.
\\
\
[MODIFY] backend/src/middleware/auth.ts
Added JWT_ISSUER and JWT_AUDIENCE constants (configurable via env vars, defaults to 'flowfi-api').
Included iss and aud in token payload during issuance in verifyChallenge.
Added iss/aud validation in verifyJwt, rejecting tokens with mismatched claims.
\\
\
[MODIFY] backend/tests/auth-jwt.test.ts
Added tests for tokens with wrong audience and wrong issuer being rejected.
Updated existing token payloads to include iss/aud.
\\
Verification Results
\
npx vitest run tests/auth-jwt.test.ts tests/auth.middleware.test.ts
✅ 11/11 passed
\\
Acceptance Criteria