fix(backend): Return TokenVerificationError from decodeJwt for undecodable tokens - #9268
fix(backend): Return TokenVerificationError from decodeJwt for undecodable tokens#9268wobsoriano wants to merge 1 commit into
Conversation
🦋 Changeset detectedLatest commit: 293de4d The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-google-signin
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
API Changes Report
Summary
No API Changes DetectedAll packages have stable APIs with no detected changes. Report generated by Break Check Last ran on |
📝 WalkthroughWalkthrough
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/backend/src/jwt/verifyJwt.ts`:
- Around line 82-96: The JWT parsing flow in verifyJwt must validate that the
decoded header and payload are non-null objects before continuing. After
JSON.parse in the try block, reject null or primitive values using the existing
Invalid JWT form TokenVerificationError path, ensuring malformed tokens such as
null parts cannot reach later destructuring and produce a TypeError.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: f42cb807-b2d0-4f1c-8dd6-9d4abaa8e863
📒 Files selected for processing (3)
.changeset/decodejwt-malformed-token.mdpackages/backend/src/jwt/__tests__/verifyJwt.test.tspackages/backend/src/jwt/verifyJwt.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/cli(auto-detected)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)
| let header, payload, signature; | ||
| try { | ||
| header = JSON.parse(decoder.decode(base64url.parse(rawHeader, { loose: true }))); | ||
| payload = JSON.parse(decoder.decode(base64url.parse(rawPayload, { loose: true }))); | ||
| signature = base64url.parse(rawSignature, { loose: true }); | ||
| } catch { | ||
| return { | ||
| errors: [ | ||
| new TokenVerificationError({ | ||
| reason: TokenVerificationErrorReason.TokenInvalid, | ||
| message: `Invalid JWT form. The header, payload, or signature could not be decoded.`, | ||
| }), | ||
| ], | ||
| }; | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== verifyJwt.ts ==\n'
sed -n '1,220p' packages/backend/src/jwt/verifyJwt.ts
printf '\n== search JWT helpers/types ==\n'
rg -n "isJwtObject|type Jwt|interface Jwt|verifyJwt|decodeJwt|TokenVerificationErrorReason" packages/backend/src/jwt packages/backend/src -g '!**/dist/**'Repository: clerk/javascript
Length of output: 32062
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,220p' packages/backend/src/jwt/verifyJwt.ts
printf '\n---\n'
rg -n "isJwtObject|type Jwt|interface Jwt|verifyJwt|decodeJwt|TokenVerificationErrorReason" packages/backend/src/jwt packages/backend/src -g '!**/dist/**'Repository: clerk/javascript
Length of output: 32015
🏁 Script executed:
#!/bin/bash
set -euo pipefail
pwd
lsRepository: clerk/javascript
Length of output: 517
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('packages/backend/src/jwt/verifyJwt.ts')
print(p.exists())
print(p)
print(p.read_text()[:4000])
PYRepository: clerk/javascript
Length of output: 4198
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== assertions.ts ==\n'
sed -n '1,260p' packages/backend/src/jwt/assertions.ts
printf '\n== Jwt types from shared package references ==\n'
rg -n "export type Jwt|export interface Jwt|type JwtPayload|interface JwtPayload" packages -g '!**/dist/**'Repository: clerk/javascript
Length of output: 7586
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== assertions.ts ==\n'
sed -n '1,260p' packages/backend/src/jwt/assertions.ts
printf '\n== Jwt types search ==\n'
rg -n "export type Jwt|export interface Jwt|type JwtPayload|interface JwtPayload" packages -g '!**/dist/**'Repository: clerk/javascript
Length of output: 7562
Reject non-object JWT parts before returning. JSON.parse can return null or a primitive here, and verifyJwt later destructures header/payload inside a catch, so tokens like bnVsbA.bnVsbA. surface a plain TypeError in errors instead of the invalid-form JWT error.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/jwt/verifyJwt.ts` around lines 82 - 96, The JWT parsing
flow in verifyJwt must validate that the decoded header and payload are non-null
objects before continuing. After JSON.parse in the try block, reject null or
primitive values using the existing Invalid JWT form TokenVerificationError
path, ensuring malformed tokens such as null parts cannot reach later
destructuring and produce a TypeError.
Sources: Coding guidelines, MCP tools
1 participant
Description
decodeJwtchecks that a token has three dot-separated segments, but thebase64url.parseandJSON.parsecalls after that check were unguarded. A token likeaaa.bbb.cccthrew a rawSyntaxErrorinstead of the documentedTokenVerificationError, andverifyTokenrejected with the sameSyntaxError.The segment parsing is now wrapped so undecodable headers, payloads, or signatures produce a
TokenVerificationErrorwith reasontoken-invalid, matching the behavior for every other malformed token shape.Fixes #9263
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change