cauthy-auth 0.23.0 → 0.24.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +3 -1
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +3 -1
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/dist/index.mjs
CHANGED
|
@@ -652,7 +652,6 @@ async function verifyWebhook(request, options = {}) {
|
|
|
652
652
|
try {
|
|
653
653
|
const verified = await jwtVerify(signature, options.jwks ?? keysOf(issuer), {
|
|
654
654
|
algorithms: ["RS256"],
|
|
655
|
-
issuer,
|
|
656
655
|
audience,
|
|
657
656
|
typ: "cauthy-webhook+jwt",
|
|
658
657
|
requiredClaims: ["exp", "iat", "jti", "body_sha256"],
|
|
@@ -663,6 +662,9 @@ async function verifyWebhook(request, options = {}) {
|
|
|
663
662
|
} catch (err) {
|
|
664
663
|
throw new CauthyWebhookError(err instanceof Error ? err.message : "bad signature");
|
|
665
664
|
}
|
|
665
|
+
if (claims.iss !== issuer && claims.domain_iss !== issuer) {
|
|
666
|
+
throw new CauthyWebhookError('unexpected "iss" claim value');
|
|
667
|
+
}
|
|
666
668
|
const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
|
|
667
669
|
if (typeof claims.iat !== "number" || claims.iat > now + 30) throw new CauthyWebhookError("signed in the future");
|
|
668
670
|
const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
|