[Backend] Add iss/aud claims to JWT payload type, issuance, and verification #1097 - #1161
Merged
ogazboiz merged 9 commits intoAug 3, 2026
Merged
Conversation
abimbolaalabi
force-pushed
the
fix/issue-1097-jwt-iss-aud-claims
branch
from
August 1, 2026 13:28
06cdc0b to
ae081ea
Compare
…fication - Added iss and aud fields to SEP10TokenPayload in auth.types.ts - Included iss/aud in token issuance at verifyChallenge - Verified iss/aud in verifyJwt, rejecting mismatches - Added tests for wrong audience and wrong issuer rejection - Updated existing tests to include iss/aud in payloads Closes LabsCrypt#1097
Root causes and fixes:
1. **JWT iss/aud validation caused 401 in integration tests**
- Updated events-list.test.ts and sse-subscribe.test.ts to include
iss/aud in signJwt payloads (matching new verifyJwt requirements)
2. **TypeScript compilation errors (18 errors)**
- indexer-state.ts: used generated Prisma IndexerState type instead
of manual interface missing createdAt
- admin-rate-limiter.middleware.ts: added optional chaining for
forwarded.split result
- soroban-indexer.service.ts: fixed startTime type by using
readString instead of raw field access; removed unused variable
- soroban-event-worker.ts: fixed BigInt/number subtraction by
converting timestamp to BigInt before operation; fixed
totalPausedDuration type by converting result back to Number
- events-wire-format.test.ts: added nullish coalescing for
HANDLER_READ_FIELDS lookup
- stream.test.ts: changed startTime/lastUpdateTime values from
number to bigint literals to match Prisma generated types
- stream.validator.test.ts: added non-null assertion for
result.error.issues access
Verification:
- npm run build (tsc): 0 errors
- auth-jwt.test.ts: 9/9 passed
- auth.middleware.test.ts: 2/2 passed
- auth.test.ts: 16/16 passed
- events-list.test.ts: 7/7 passed
- sse-subscribe.test.ts: 2/2 passed
Closes LabsCrypt#1097
abimbolaalabi
force-pushed
the
fix/issue-1097-jwt-iss-aud-claims
branch
from
August 3, 2026 10:29
ae081ea to
a3b278a
Compare
ogazboiz
approved these changes
Aug 3, 2026
ogazboiz
left a comment
ogazboiz
left a comment
Contributor
There was a problem hiding this comment.
strong work. iss and aud are not just issued but enforced in verifyJwt (wrong issuer or audience returns null), env-configurable with sane defaults, and the wrong-issuer and wrong-audience rejection tests are exactly right. the bundled main-CI repairs (BigInt test alignment, IndexerState type, duplicate @@unique dedupe) also heal the currently red main, so this goes in first. merging.
if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0
3 tasks
This was referenced Aug 3, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR adds issuer (iss) and audience (aud) claims to the SEP-10 JWT payload, ensuring tokens are bound to a specific issuer and audience. This prevents token replay across services sharing the same signing secret by adding defense-in-depth validation on verification.
Related Issue
Closes #1097
Changes
\
[MODIFY] backend/src/types/auth.types.ts
Added iss: string and aud: string fields to SEP10TokenPayload interface.
\\
\
[MODIFY] backend/src/middleware/auth.ts
Added JWT_ISSUER and JWT_AUDIENCE constants (configurable via env vars, defaults to 'flowfi-api').
Included iss and aud in token payload during issuance in verifyChallenge.
Added iss/aud validation in verifyJwt, rejecting tokens with mismatched claims.
\\
\
[MODIFY] backend/tests/auth-jwt.test.ts
Added tests for tokens with wrong audience and wrong issuer being rejected.
Updated existing token payloads to include iss/aud.
\\
Verification Results
\
npx vitest run tests/auth-jwt.test.ts tests/auth.middleware.test.ts
✅ 11/11 passed
\\
Acceptance Criteria