Improve withApiKey auth middleware
#226
Conversation
andrii-balitskyi
commented
Nov 29, 2024
andrii-balitskyi
commented
- Improve withApiKey auth middleware
- ci: Format code
- Test
|
Bundle |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const invalidKeyErr = await t.throwsAsync<SimpleAxiosError>( | ||
| axios.get("/devices/list", { | ||
| headers: { | ||
| Authorization: "Bearer invalid_api_key", |
Check failure
Code scanning / CodeQL
Hard-coded credentials Critical test
| const clientSessionErr = await t.throwsAsync<SimpleAxiosError>( | ||
| axios.get("/devices/list", { | ||
| headers: { | ||
| Authorization: `Bearer seam_cst1_123`, |
Check failure
Code scanning / CodeQL
Hard-coded credentials Critical test
| const accessTokenErr = await t.throwsAsync<SimpleAxiosError>( | ||
| axios.get("/devices/list", { | ||
| headers: { | ||
| Authorization: `Bearer seam_at_123`, |
Check failure
Code scanning / CodeQL
Hard-coded credentials Critical test
| t.is(accessTokenErr?.response.error.type, "access_token_used_for_api_key") | ||
|
|
||
| // Test using JWT instead of API key | ||
| const token = jwt.sign({ some: "payload" }, "secret") |
Check failure
Code scanning / CodeQL
Hard-coded credentials Critical test
| let decodedJwt | ||
| try { | ||
| decodedJwt = jwt.decode(token) | ||
| } catch {} | ||
| if (decodedJwt != null) { | ||
| throw new UnauthorizedException({ | ||
| type: "unauthorized", | ||
| message: "A JWT was used instead of an API key", | ||
| }) | ||
| } |
There was a problem hiding this comment.
This block is incorrect in seam-connect but I fixed it here.
In seam-connect it'll never throw when JWT is provided because the error gets always caught being in the try block: https://github.com/seamapi/seam-connect/blob/486c564a7138bca4cd93ce51d6370bee4405fcbd/lib/middlewares/api-key-auth.ts#L54-L61.
Created an issue: https://github.com/seamapi/seam-connect/issues/9520
