Enable header.typ assertion
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- authentication, security
Research direction
Start by tracing the JWT verification entry point and how verification options are parsed, then inspect where token headers are validated. Use RFC 9068 to confirm the expected typ value and define completion as verification failing when the configured type is absent or different, while existing behavior remains unchanged when no type is configured.
Written by the indexing model from the issue text.
Description
Describe the problem you'd like to have solved
I would like to be able to differentiate between access tokens and identity tokens, and specifically to fail JWT validation if the token is not an access token.
Describe the ideal solution
We can assert that a token is an access token but checking the typ header for the value at+jwt. See https://datatracker.ietf.org/doc/rfc9068/
I would like to have a typ option which I could set to the required value, with JWT verification failing if the expected type is not found in the header.
Alternatives and current work-arounds
Do not share identity token to clients, so they cannot present id_token for authentication.
Additional context
n/a
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Automattic/safe-publish#594 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
dream-num/dsh-univer-office#104 ·
-
comp/dashboard invalid P3
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
NousResearch/hermes-agent#121143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
avniproject/avni-webapp#1811 ·
-
area/auroraboot area/webui bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100