prehistoric-systems/omnivore
1
0
Fork 0
mirror of https://github.com/omnivore-app/omnivore.git synced 2026-03-11 08:54:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

verify apple token with both audience names used for the app

Browse source
This commit is contained in:
Satindar Dhillon 2022-08-28 09:55:41 -07:00
parent a720d5a5d5
commit 3f6ade9614
1 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
packages/api/src/routers/auth/apple_auth.ts
View file

@ -41,8 +41,7 @@ async function fetchApplePublicKey(kid: string): Promise<string | null> {
}
export async function decodeAppleToken(
token: string,
isWeb?: boolean
token: string
): Promise<DecodeTokenResult> {
const decodedToken = jwt.decode(token, { complete: true })
const { kid, alg } = (decodedToken as any).header
@ -54,8 +53,8 @@ export async function decodeAppleToken(
}
const jwtClaims: any = jwt.verify(token, publicKey, { algorithms: [alg] })
const issVerified = (jwtClaims.iss ?? '') === appleBaseURL
const audVerified =
(jwtClaims.aud ?? '') === isWeb ? webAudienceName : audienceName
const audience = jwtClaims.aud ?? ''
const audVerified = audience == webAudienceName || audience === audienceName
if (issVerified && audVerified && jwtClaims.email) {
return {
email: jwtClaims.email,
@ -106,7 +105,7 @@ export async function handleAppleWebAuth(
return env.client.url
}
const decodedTokenResult = await decodeAppleToken(idToken, true)
const decodedTokenResult = await decodeAppleToken(idToken)
const authFailedRedirect = `${baseURL()}/login?errorCodes=${
LoginErrorCode.AuthFailed
}`