From d86666406404b8dd45b61a4fef9c74ac1eefb33f Mon Sep 17 00:00:00 2001 From: Mabe Date: Sun, 21 Jun 2026 17:31:55 +0200 Subject: [PATCH] fix: enhance JWT validation by adding audience verification options and logging --- backend/app/auth.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/backend/app/auth.py b/backend/app/auth.py index f8e74d8..272009e 100644 --- a/backend/app/auth.py +++ b/backend/app/auth.py @@ -127,16 +127,21 @@ async def validate_token(credentials: HTTPAuthorizationCredentials = Security(se logger.debug("Validating token with JWKS; issuer=%s, audience=%s", discovery.get("issuer"), settings.oidc_audience) # Only pass `audience` to the decoder if configured. Some providers # (or local development setups) may not include the aud claim in a - # way that matches your API identifier; in that case leave - # `OIDC_AUDIENCE` unset and the audience check will be skipped. + # way that matches your API identifier; in that case disable audience + # verification in python-jose instead of passing audience=None. jwt_kwargs = { "algorithms": [key.get("alg", "RS256")], - "issuer": discovery.get("issuer") if settings.oidc_verify_iss else None, } + options = {"verify_signature": True} + if settings.oidc_verify_iss: + jwt_kwargs["issuer"] = discovery.get("issuer") if settings.oidc_audience: jwt_kwargs["audience"] = settings.oidc_audience + else: + options["verify_aud"] = False - verified = jwt.decode(token, public_key, **jwt_kwargs) + logger.debug("JWT decode args: options=%s, jwt_kwargs=%s", options, jwt_kwargs) + verified = jwt.decode(token, public_key, options=options, **jwt_kwargs) logger.debug("JWT validation succeeded; claims=%s", verified) except JWTError: logger.exception("JWT validation failed, attempting introspection")