awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 11:38:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): fips validated JWT's

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-08 18:28:43 +04:00
parent ea708513ad
commit 2c50de28bd
44 changed files with 779 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts
+7 -5
View File
@@ -12,6 +12,8 @@ import {
} from "@app/ee/services/permission/permission-fns";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto";
import { CompleteJWTPayload } from "@app/lib/crypto/cryptography/types";
import {
BadRequestError,
ForbiddenRequestError,
@@ -79,7 +81,7 @@ export const identityJwtAuthServiceFactory = ({
orgId: identityMembershipOrg.orgId
});
const decodedToken = jwt.decode(jwtValue, { complete: true });
const decodedToken = crypto.jwt().decode(jwtValue, { complete: true }) as CompleteJWTPayload;
if (!decodedToken) {
throw new UnauthorizedError({
message: "Invalid JWT"
@@ -106,11 +108,11 @@ export const identityJwtAuthServiceFactory = ({
});
}
const { kid } = decodedToken.header;
const { kid } = decodedToken.header as { kid: string };
const jwtSigningKey = await client.getSigningKey(kid);
try {
tokenData = jwt.verify(jwtValue, jwtSigningKey.getPublicKey()) as Record<string, string>;
tokenData = crypto.jwt().verify(jwtValue, jwtSigningKey.getPublicKey()) as Record<string, string>;
} catch (error) {
if (error instanceof jwt.JsonWebTokenError) {
throw new UnauthorizedError({
@@ -129,7 +131,7 @@ export const identityJwtAuthServiceFactory = ({
let isMatchAnyKey = false;
for (const publicKey of decryptedPublicKeys) {
try {
tokenData = jwt.verify(jwtValue, publicKey) as Record<string, string>;
tokenData = crypto.jwt().verify(jwtValue, publicKey) as Record<string, string>;
isMatchAnyKey = true;
} catch (error) {
if (error instanceof jwt.JsonWebTokenError) {
@@ -225,7 +227,7 @@ export const identityJwtAuthServiceFactory = ({
});
const appCfg = getConfig();
const accessToken = jwt.sign(
const accessToken = crypto.jwt().sign(
{
identityId: identityJwtAuth.identityId,
identityAccessTokenId: identityAccessToken.id,