@udibo/oauth2 0.29.0 → 0.30.0

package/dist/server/jwks-token-reader.d.ts

@@ -2,10 +2,11 @@
  * Token reader that validates JWT access tokens locally against the
  * issuer's published JWKS, with no per-request network hop.
  *
- * This is the validating half of RFC 9068 (`at+jwt`): the authorization
- * server signs access tokens and publishes its public keys at a `jwks_uri`;
- * the resource server fetches those keys once, caches them, and verifies
- * every subsequent token in-process. Signature verification uses Web Crypto
+ * It validates RFC 9068 (`at+jwt`) access tokens: the authorization server
+ * signs access tokens and publishes its public keys at a `jwks_uri`; the
+ * resource server fetches those keys once, caches them, and verifies every
+ * subsequent token in-process, including the `typ` header and every claim
+ * RFC 9068 §2.2 makes REQUIRED. Signature verification uses Web Crypto
  * only — the package takes no JOSE dependency.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc9068
@@ -27,19 +28,25 @@ import type { TokenReaderInterface } from "./services/token.ts";
 export interface JwtAccessTokenClaims {
     /** Issuer that signed the token. Verified against the configured issuer. */
     iss: string;
-    /** Subject — the end user, or the client itself for client-credentials tokens. */
-    sub?: string;
+    /** Subject — the end user, or the client itself for client-credentials tokens. Required. */
+    sub: string;
     /** Audience(s) the token is intended for. Verified against the configured audience. */
     aud: string | string[];
     /** Expiration time, seconds since the epoch. */
     exp: number;
-    /** Issued-at time, seconds since the epoch. */
-    iat?: number;
+    /** Issued-at time, seconds since the epoch. Required. */
+    iat: number;
     /** Not-before time, seconds since the epoch. */
     nbf?: number;
-    /** Unique token identifier. */
+    /**
+     * Unique token identifier. Required unless
+     * {@linkcode JwksTokenReaderOptions.tokenIdClaim} names another claim.
+     */
     jti?: string;
-    /** Client the token was issued to. */
+    /**
+     * Client the token was issued to. Required unless
+     * {@linkcode JwksTokenReaderOptions.clientIdClaim} names another claim.
+     */
     client_id?: string;
     /** Space-delimited granted scopes. */
     scope?: string;
@@ -105,9 +112,18 @@ export interface JwksTokenReaderOptions<Client extends ClientInterface, User, S
      * §2.2 makes `client_id` REQUIRED, and its absence is what tells an
      * `id_token` apart from an access token). Defaults to `"client_id"`; point
      * it at the vendor claim for issuers that deviate — Okta's `cid`, Azure
-     * AD v1's `appid`. There is deliberately no way to drop the requirement.
+     * AD v1's `appid`. The requirement cannot be turned off, but pointing this
+     * at a claim every token carries defeats it.
      */
     clientIdClaim?: string;
+    /**
+     * Claim carrying the unique token identifier, required on every accepted
+     * token (RFC 9068 §2.2 makes `jti` REQUIRED). Defaults to `"jti"`; point it
+     * at the vendor claim for issuers that deviate — Microsoft Entra ID's
+     * `uti`. The requirement cannot be turned off, but pointing this at a claim
+     * every token carries defeats it.
+     */
+    tokenIdClaim?: string;
     /**
      * Leeway in seconds applied to `exp` and `nbf` to absorb clock drift
      * between the issuer and this server. Defaults to 30. Must be finite and
@@ -239,7 +255,8 @@ export declare class JwksTokenReader<Client extends ClientInterface, User, S ext
     #private;
     /**
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
-     * required as `typ`, `client_id` as the required client-id claim, 30
+     * required as `typ`, `client_id` as the required client-id claim, `jti` as
+     * the required token-identifier claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
      * between fetches, a 5-second request deadline, a 256 KiB response cap,
      * {@linkcode BasicScope}, and the global `fetch`.

package/dist/server/jwks-token-reader.js

@@ -2,10 +2,11 @@
  * Token reader that validates JWT access tokens locally against the
  * issuer's published JWKS, with no per-request network hop.
  *
- * This is the validating half of RFC 9068 (`at+jwt`): the authorization
- * server signs access tokens and publishes its public keys at a `jwks_uri`;
- * the resource server fetches those keys once, caches them, and verifies
- * every subsequent token in-process. Signature verification uses Web Crypto
+ * It validates RFC 9068 (`at+jwt`) access tokens: the authorization server
+ * signs access tokens and publishes its public keys at a `jwks_uri`; the
+ * resource server fetches those keys once, caches them, and verifies every
+ * subsequent token in-process, including the `typ` header and every claim
+ * RFC 9068 §2.2 makes REQUIRED. Signature verification uses Web Crypto
  * only — the package takes no JOSE dependency.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc9068
@@ -208,6 +209,7 @@ export class JwksTokenReader {
     #algorithms;
     #types;
     #clientIdClaim;
+    #tokenIdClaim;
     #clockSkewSeconds;
     #cacheMaxAgeMs;
     #minFetchIntervalMs;
@@ -225,7 +227,8 @@ export class JwksTokenReader {
     #inFlight;
     /**
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
-     * required as `typ`, `client_id` as the required client-id claim, 30
+     * required as `typ`, `client_id` as the required client-id claim, `jti` as
+     * the required token-identifier claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
      * between fetches, a 5-second request deadline, a 256 KiB response cap,
      * {@linkcode BasicScope}, and the global `fetch`.
@@ -254,6 +257,7 @@ export class JwksTokenReader {
         }
         this.#types = (options.types ?? ["at+jwt"]).map(normalizeType);
         this.#clientIdClaim = options.clientIdClaim ?? "client_id";
+        this.#tokenIdClaim = options.tokenIdClaim ?? "jti";
         this.#clockSkewSeconds = options.clockSkewSeconds ?? 30;
         assertClockSkewSeconds(this.#clockSkewSeconds);
         this.#cacheMaxAgeMs = options.cacheMaxAgeMs ?? 600_000;
@@ -336,9 +340,14 @@ export class JwksTokenReader {
     #validClaims(claims) {
         if (claims.iss !== this.#issuer)
             return false;
-        const clientId = claims[this.#clientIdClaim];
-        if (typeof clientId !== "string" || !clientId)
+        for (const claim of [this.#clientIdClaim, this.#tokenIdClaim, "sub"]) {
+            const value = claims[claim];
+            if (typeof value !== "string" || !value)
+                return false;
+        }
+        if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)) {
             return false;
+        }
         for (const claim of ID_TOKEN_ONLY_CLAIMS) {
             if (claims[claim] !== undefined)
                 return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",