jwt_auth_cognito 1.0.0.pre.beta.9 → 1.0.0.pre.beta.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ec0550d58a587e152aa1a4c41cfce13691bb016f0b12e4525a671bc7fda153b
-  data.tar.gz: 77a05aeb998b6bdeb8df90ffc93a78a3ad1c3565aeda43d4bdcf069713bb6295
+  metadata.gz: 97be07f0c6be821ad157fcf5c6b7a173fc6866145d2b738481aaa3b912c39703
+  data.tar.gz: 28f5119547d00881a8ccb84be5ca584cf81394a4ba1ce86cf1d5306855037f15
 SHA512:
-  metadata.gz: 5a5f6a72cfebb9e1f805ba53b3561c544b2afc18f993af0759da596c02401e6bda2725a58837e2b5db1b818a5f44ae730c8b9057aa0a481530e8f3c035b70ae1
-  data.tar.gz: 21e84bde860ae1d70dce2ecf5d32a40bcd6fb18af8eb815de9c6079de7996a9a488871c3b91eca0fd649c41d900863c155948e9c96caff507c75b3de3b9110b1
+  metadata.gz: e0d17203f3fdba6311fd43d56a451f4e454015f37ab91c7f1231ac334d2c8fb92b2c6fc05b08d109acd0386b3754fec1be1cc5b4bb5ae7e15e4483d9527f9d38
+  data.tar.gz: cc89ebd874a97fdac6fd6fe9c417d9e53f41658aab723a47e4df0c3551fe64dc447c507035d8daa42696a29f342a60d8c4a7987a5f880dd589d5ad41e8414805

data/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0-beta.10] - 2025-01-23
+
+### Fixed
+
+- **Audience Validation**: Fixed overly strict audience validation for AWS Cognito access tokens
+  - Access tokens from Cognito typically don't include 'aud' claim, only ID tokens do
+  - Modified JWKS validation to only enforce audience checking for ID tokens (`token_use: 'id'`)
+  - Access tokens (`token_use: 'access'`) now skip audience validation as per AWS Cognito standards
+  - Resolves "Invalid audience. Expected [client_id], received <none>" error for access tokens
+  - Maintains proper security validation for ID tokens
+
+### Improved
+
+- **JWT Standards Compliance**: Enhanced compatibility with AWS Cognito token specifications
+  - Pre-decodes tokens to determine type before applying validation rules
+  - Follows AWS Cognito best practices for token type-specific validation
+  - Maintains backward compatibility with existing ID token validation
+
 ## [1.0.0-beta.9] - 2025-01-22
 
 ### Fixed

data/CLAUDE.md

@@ -304,7 +304,7 @@ JWKS_CACHE_TTL=3600  # 1 hour
 
 ## Version Compatibility
 
-### ✅ **Updated January 2025 - Version 1.0.0-beta.6**
+### ✅ **Updated January 2025 - Version 1.0.0-beta.10**
 
 **Stable production-ready beta with complete pipeline compatibility**
 

data/lib/jwt_auth_cognito/jwks_service.rb

@@ -23,6 +23,13 @@ module JwtAuthCognito
       raise ValidationError, 'Token missing key ID (kid)' unless kid
 
       public_key = get_public_key(kid)
+      # First decode to check token type before audience validation
+      payload_preview = JWT.decode(token, nil, false).first
+
+      # Only verify audience for ID tokens, not access tokens
+      # Access tokens from Cognito might not have 'aud' claim
+      should_verify_aud = @config.cognito_client_id && payload_preview['token_use'] == 'id'
+
       decoded_token = JWT.decode(
         token,
         public_key,
@@ -31,8 +38,8 @@ module JwtAuthCognito
           algorithm: 'RS256',
           iss: @config.cognito_issuer,
           verify_iss: true,
-          aud: @config.cognito_client_id,
-          verify_aud: @config.cognito_client_id ? true : false
+          aud: should_verify_aud ? @config.cognito_client_id : nil,
+          verify_aud: should_verify_aud
         }
       )
 

data/lib/jwt_auth_cognito/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JwtAuthCognito
-  VERSION = '1.0.0-beta.9'
+  VERSION = '1.0.0-beta.10'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_auth_cognito
 version: !ruby/object:Gem::Version
-  version: 1.0.0.pre.beta.9
+  version: 1.0.0.pre.beta.10
 platform: ruby
 authors:
 - The Optimal
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-09-22 00:00:00.000000000 Z
+date: 2025-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ssm