feat: secure Service Account session config using signed JWT cookies - #67
Open
dylan-klein wants to merge 3 commits into
Open
feat: secure Service Account session config using signed JWT cookies#67dylan-klein wants to merge 3 commits into
dylan-klein wants to merge 3 commits into
Conversation
TAG=agy CONV=b3471264-2592-4924-b031-267b4bf62326
…verification - Calculate and add exp claim (30 days) to the signed JWT payload during sa-config setup POST. - Enforce expiration validation in verifyJwt, returning null if current time is past the exp claim. - Update unit tests in sa-session.test.ts to verify fallback to env variables on expired JWT session cookie. - Fix integration tests in sa-config-route.test.ts to verify dynamic exp claims inside signed JWT payloads. TAG=agy CONV=b3471264-2592-4924-b031-267b4bf62326
- Updated Next.js middleware in src/proxy.ts to read and cryptographically verify COOKIE_SA_SESSION (cep_sa_session JWT) instead of the deprecated raw cep_sa_customer_id cookie when checking if a Service Account customer is configured. - Updated integration tests in src/__tests__/integration/proxy.test.ts to sign and pass mock JWT cookies in test requests, ensuring the MCP reachability gate tests don't fail-fast redirect to setup. - Added new integration tests validating that correct JWT SA sessions allow dashboard access, while invalid/unregistered JWTs redirect to setup. - Fixed auto-formatting on src/__tests__/unit/auth-errors.test.ts, src/lib/activity-data.ts, and src/lib/session.ts. TAG=agy CONV=b3471264-2592-4924-b031-267b4bf62326
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MOTIVATION
Previously, Service Account configuration parameters (
customerIdandimpersonatedUser) were stored as plain-text cookies in the browser. This made the application vulnerable to session tampering, where a user could manually edit the cookie values in the browser console to switch their tenant context and access other Workspace domains.MAIN CHANGES
src/lib/jwt.tsusing Node's nativecryptomodule.cep_sa_sessioncookie usingBETTER_AUTH_SECRETas the key.getServiceAccountConfiginsrc/lib/sa-session.tsto verify the signature of the session JWT before returning values.exp(expiration) claim to the JWT payload set to 30 days, matching the browser cookie lifetime, and enforced expiration verification to block token replay attacks./api/auth/sa-configto write the signed JWT on configuration setup and clear it on reset, deleting legacy plain-text cookies.DESIGN DECISIONS
TAG=agy
CONV=b3471264-2592-4924-b031-267b4bf62326