From 0bcb763350c924204a374e54764fbde048b4997e Mon Sep 17 00:00:00 2001 From: David Humphrey Date: Wed, 24 Feb 2021 12:01:06 -0500 Subject: [PATCH] Include audience claim in token --- src/api/auth/src/token.js | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/api/auth/src/token.js b/src/api/auth/src/token.js index 73759c3334..1120e226a5 100644 --- a/src/api/auth/src/token.js +++ b/src/api/auth/src/token.js @@ -1,5 +1,7 @@ const jwt = require('jsonwebtoken'); +const { JWT_ISSUER, JWT_AUDIENCE } = process.env; + // TODO - proper signing with RS256 keys const secret = 'TODO - use RS256 signing...'; const issuer = process.env.JWT_ISSUER; @@ -8,11 +10,12 @@ function createToken(audience, subject) { // TODO - figure out all the various claims we need to use const payload = { // The token is issued by us (e.g., this server) - iss: process.env.JWT_ISSUER, - // It is intended for the app running at the specified origin - aud: audience, + iss: JWT_ISSUER, + // It is intended for the services running at this api origin + aud: JWT_AUDIENCE, // The subject of this token, the user sub: subject, + // TODO: role info (e.g., admin) }; const options = { expiresIn: process.env.JWT_EXPIRES_IN || '1h' };