From 3f6ade9614b335cd5b9aacd5cd77dcad91a92175 Mon Sep 17 00:00:00 2001 From: Satindar Dhillon Date: Sun, 28 Aug 2022 09:55:41 -0700 Subject: [PATCH] verify apple token with both audience names used for the app --- packages/api/src/routers/auth/apple_auth.ts | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/packages/api/src/routers/auth/apple_auth.ts b/packages/api/src/routers/auth/apple_auth.ts index 07404924a..c11fef607 100644 --- a/packages/api/src/routers/auth/apple_auth.ts +++ b/packages/api/src/routers/auth/apple_auth.ts @@ -41,8 +41,7 @@ async function fetchApplePublicKey(kid: string): Promise { } export async function decodeAppleToken( - token: string, - isWeb?: boolean + token: string ): Promise { const decodedToken = jwt.decode(token, { complete: true }) const { kid, alg } = (decodedToken as any).header @@ -54,8 +53,8 @@ export async function decodeAppleToken( } const jwtClaims: any = jwt.verify(token, publicKey, { algorithms: [alg] }) const issVerified = (jwtClaims.iss ?? '') === appleBaseURL - const audVerified = - (jwtClaims.aud ?? '') === isWeb ? webAudienceName : audienceName + const audience = jwtClaims.aud ?? '' + const audVerified = audience == webAudienceName || audience === audienceName if (issVerified && audVerified && jwtClaims.email) { return { email: jwtClaims.email, @@ -106,7 +105,7 @@ export async function handleAppleWebAuth( return env.client.url } - const decodedTokenResult = await decodeAppleToken(idToken, true) + const decodedTokenResult = await decodeAppleToken(idToken) const authFailedRedirect = `${baseURL()}/login?errorCodes=${ LoginErrorCode.AuthFailed }`