fix: added verification check if data token is not changed

labd · Jan 16, 2025 · c76ecca · c76ecca
1 parent de2a9c7
commit c76ecca
Show file tree

Hide file tree

Showing 3 changed files with 41 additions and 10 deletions.
diff --git a/packages/apollo/src/gateway.ts b/packages/apollo/src/gateway.ts
@@ -55,7 +55,7 @@ export class GatewayAuthPlugin<TContext extends PublicFederatedTokenContext>
 
 		if (accessToken) {
 			try {
-				await token.loadAccessJWT(this.signer, accessToken, dataToken);
+				await token.loadAccessJWT(this.signer, accessToken);
 			} catch (e: unknown) {
 				this.tokenSource.deleteAccessToken(contextValue.req, contextValue.res);
 
@@ -88,6 +88,33 @@ export class GatewayAuthPlugin<TContext extends PublicFederatedTokenContext>
 				this.tokenSource.deleteRefreshToken(contextValue.req, contextValue.res);
 			}
 		}
+
+		if (dataToken) {
+			try {
+				await token.loadDataJWT(this.signer, dataToken);
+			} catch (e: unknown) {
+				this.tokenSource.deleteDataToken(contextValue.req, contextValue.res);
+				if (e instanceof TokenExpiredError) {
+					throw new GraphQLError("Your token has expired.", {
+						extensions: {
+							code: "UNAUTHENTICATED",
+							http: {
+								statusCode: 401,
+							},
+						},
+					});
+				} else {
+					throw new GraphQLError("Your token is invalid.", {
+						extensions: {
+							code: "INVALID_TOKEN",
+							http: {
+								statusCode: 400,
+							},
+						},
+					});
+				}
+			}
+		}
 		return this;
 	}
 

diff --git a/packages/core/src/jwt.test.ts b/packages/core/src/jwt.test.ts
@@ -41,7 +41,7 @@ describe("PublicFederatedToken", async () => {
 		const dataToken = await token.createDataJWT(signer);
 
 		const newToken = new PublicFederatedToken();
-		await newToken.loadAccessJWT(signer, accessToken, dataToken);
+		await newToken.loadAccessJWT(signer, accessToken);
 		expect(newToken.tokens).toStrictEqual(token.tokens);
 		expect(newToken.refreshTokens).toStrictEqual(token.refreshTokens);
 		expect(newToken.values).toStrictEqual(token.values);
@@ -71,7 +71,7 @@ describe("PublicFederatedToken", async () => {
 		const dataToken = await token.createDataJWT(signer);
 
 		const newToken = new PublicFederatedToken();
-		await newToken.loadAccessJWT(signer, accessToken, dataToken);
+		await newToken.loadAccessJWT(signer, accessToken);
 		expect(newToken.tokens).toStrictEqual(token.tokens);
 		expect(newToken.refreshTokens).toStrictEqual(token.refreshTokens);
 		expect(newToken.values).toStrictEqual(token.values);
@@ -101,7 +101,7 @@ describe("PublicFederatedToken", async () => {
 		);
 
 		const token = new PublicFederatedToken();
-		await token.loadAccessJWT(signer, tokenJWT, dataJWT);
+		await token.loadAccessJWT(signer, tokenJWT);
 		expect(token.tokens).toStrictEqual({
 			exampleName: {
 				token: "exampleToken",

diff --git a/packages/core/src/jwt.ts b/packages/core/src/jwt.ts
@@ -43,7 +43,16 @@ export class PublicFederatedToken extends FederatedToken {
 		return await signer.encryptJWT(data, exp);
 	}
 
-	async loadAccessJWT(signer: TokenSigner, value: string, data?: string) {
+	async loadDataJWT(signer: TokenSigner, value: string) {
+		const result = await signer.verifyJWT(value);
+		if (!result) {
+			throw new TokenInvalidError("Invalid JWT");
+		}
+
+		this.values = result.payload.values as Record<string, any>;
+	}
+
+	async loadAccessJWT(signer: TokenSigner, value: string) {
 		const result = await signer.decryptJWT(value);
 		if (!result) {
 			throw new Error("Invalid JWT");
@@ -67,11 +76,6 @@ export class PublicFederatedToken extends FederatedToken {
 		} else {
 			this.setIsAnonymous();
 		}
-
-		if (data) {
-			const result = await signer.verifyJWT(data);
-			this.values = result.payload.values as Record<string, any>;
-		}
 	}
 
 	// createRefreshJWT encrypts the refresh token and return a JWT. The token is