jajaperson/nestjs-auth0

JWT strategy domain issue

Closed this issue · 1 comments

kkoomen commented

You have a problem in your code:

super({
  secretOrKeyProvider: passportJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://${configService.get<string>(
      'auth.domain',
    )}/.well-known/jwks.json`,
  }),

  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
  audience: configService.get<string>('auth.audience'),
  issuer: `https://${configService.get<string>('auth.domain')}`,
  algorithms: ['RS256'],
});

the issuer property must end with a slash. I suggest you do this:

const issuerUrl = configService.get<string>('auth.domain').replace(/\/*$/, '');
super({
  secretOrKeyProvider: passportJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://${issuerUrl}/.well-known/jwks.json`,
  }),

  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
  audience: configService.get<string>('auth.audience'),
  issuer: `https://${issuerUrl}/`,
  algorithms: ['RS256'],
});

to always ensure it's passed correctly.

jajaperson commented

Sorry, it took a while, it should be fixed now.

  • 👍1