feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brkalow merged 7 commits into from
Apr 10, 2024
Merged

feat(nextjs): Add signature verification of token passed from middleware #3121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6ae6a40
feat(nextjs): Add signature verification of token passed from middleware
brkalow Apr 4, 2024
d3a6817
chore(repo): Adds changeset
brkalow Apr 4, 2024
92de811
chore(fastify): Update snapshot
brkalow Apr 5, 2024
6e25aef
Merge branch 'main' into brk.feat/next-token-signature
brkalow Apr 10, 2024
9360cc2
chore(nextjs): Pin crypto-js version
brkalow Apr 10, 2024
e58fce0
chore(nextjs): Tweak error message
brkalow Apr 10, 2024
261639b
Merge branch 'main' into brk.feat/next-token-signature
brkalow Apr 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .changeset/clean-deers-mate.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.
13 changes: 13 additions & 0 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions packages/backend/src/constants.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
AuthToken: '__clerkAuthToken',
AuthSignature: '__clerkAuthSignature',
AuthStatus: '__clerkAuthStatus',
AuthReason: '__clerkAuthReason',
AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
AuthToken: 'x-clerk-auth-token',
AuthSignature: 'x-clerk-auth-signature',
AuthStatus: 'x-clerk-auth-status',
AuthReason: 'x-clerk-auth-reason',
AuthMessage: 'x-clerk-auth-message',
Expand Down
1 change: 1 addition & 0 deletions packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
"Accept": "accept",
"AuthMessage": "x-clerk-auth-message",
"AuthReason": "x-clerk-auth-reason",
"AuthSignature": "x-clerk-auth-signature",
"AuthStatus": "x-clerk-auth-status",
"AuthToken": "x-clerk-auth-token",
"Authorization": "authorization",
Expand Down
2 changes: 2 additions & 0 deletions packages/nextjs/package.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
"@clerk/backend": "1.0.0-beta.33",
"@clerk/clerk-react": "5.0.0-beta.36",
"@clerk/shared": "2.0.0-beta.21",
"crypto-js": "4.2.0",
"path-to-regexp": "6.2.1",
"tslib": "2.4.1"
},
"devDependencies": {
"@clerk/types": "4.0.0-beta.25",
"@types/crypto-js": "4.2.2",
"@types/node": "^18.17.0",
"@types/react": "*",
"@types/react-dom": "*",
Expand Down
25 changes: 23 additions & 2 deletions packages/nextjs/src/server/__tests__/createGetAuth.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
it('returns a getAuth function', () => {
expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
headers: new Headers({
[constants.Headers.AuthStatus]: AuthStatus.SignedIn,
[constants.Headers.AuthToken]: mockToken,
[constants.Headers.AuthSignature]: mockTokenSignature,
[constants.Headers.AuthMessage]: 'message',
[constants.Headers.AuthReason]: 'reason',
}),
});

expect(getAuth(req).userId).toEqual('user-id');
expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
});

it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
headers: new Headers({
[constants.Headers.AuthStatus]: AuthStatus.SignedIn,
[constants.Headers.AuthToken]: mockToken,
[constants.Headers.AuthSignature]: mockTokenSignature,
[constants.Headers.AuthMessage]: 'message',
[constants.Headers.AuthReason]: 'reason',
Cookie: `__session=${mockToken2};`,
}),
});

expect(getAuth(req).userId).toEqual('user-id');
expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
});

it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

expect(() => getAuth(req)).toThrowError();
});

it('throws if signature does not match token', () => {
const req = new NextRequest('https://www.clerk.com', {
headers: new Headers({
[constants.Headers.AuthStatus]: AuthStatus.SignedIn,
[constants.Headers.AuthToken]: mockToken2,
[constants.Headers.AuthSignature]: mockTokenSignature,
[constants.Headers.AuthMessage]: 'message',
[constants.Headers.AuthReason]: 'reason',
}),
});

expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
});
});
2 changes: 1 addition & 1 deletion packages/nextjs/src/server/authMiddleware.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
}

const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

if (requestState.headers) {
requestState.headers.forEach((value, key) => {
Expand Down
2 changes: 1 addition & 1 deletion packages/nextjs/src/server/clerkMiddleware.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
}

decorateRequest(clerkRequest, handlerResult, requestState);
decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

// TODO @nikos: we need to make this more generic
// and move the logic in clerk/backend
Expand Down
5 changes: 4 additions & 1 deletion packages/nextjs/src/server/createGetAuth.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
// Then, we don't have to re-verify the JWT here,
// we can just strip out the claims manually.
const authToken = getAuthKeyFromRequest(req, 'AuthToken');
const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
const authReason = getAuthKeyFromRequest(req, 'AuthReason');
const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
logger.debug('Options debug', options);

if (authStatus === AuthStatus.SignedIn) {
assertTokenSignature(authToken as string, options.secretKey, authSignature);

const jwt = decodeJwt(authToken as string);

logger.debug('JWT debug', jwt.raw.text);
Expand Down
2 changes: 2 additions & 0 deletions packages/nextjs/src/server/errors.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;
32 changes: 30 additions & 2 deletions packages/nextjs/src/server/utils.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
req: ClerkRequest,
res: Response,
requestState: RequestState,
secretKey: string,
): Response {
const { reason, message, status, token } = requestState;
// pass-through case, convert to next()
if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
setRequestHeadersOnNextResponse(res, req, {
[constants.Headers.AuthStatus]: status,
[constants.Headers.AuthToken]: token || '',
[constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
[constants.Headers.AuthMessage]: message || '',
[constants.Headers.AuthReason]: reason || '',
[constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

return key;
}

/**
* Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
*/
function createTokenSignature(token: string, key: string): string {
return hmacSHA1(token, key).toString();
}

/**
* Assert that the provided token generates a matching signature.
*/
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
if (!signature) {
throw new Error(authSignatureInvalid);
}

const expectedSignature = createTokenSignature(token, key);
if (expectedSignature !== signature) {
throw new Error(authSignatureInvalid);
}
}
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(nextjs): Add signature verification of token passed from middleware#3121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brkalow
merged 7 commits into

from

Apr 10, 2024
 Merged


feat(nextjs): Add signature verification of token passed from middleware
#3121
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6ae6a40

feat(nextjs): Add signature verification of token passed from middleware


brkalow Apr 4, 2024
d3a6817

chore(repo): Adds changeset


brkalow Apr 4, 2024
92de811

chore(fastify): Update snapshot


brkalow Apr 5, 2024
6e25aef

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024
9360cc2

chore(nextjs): Pin crypto-js version


brkalow Apr 10, 2024
e58fce0

chore(nextjs): Tweak error message


brkalow Apr 10, 2024
261639b

Merge branch 'main' into brk.feat/next-token-signature


brkalow Apr 10, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/clean-deers-mate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
'@clerk/backend': minor
'@clerk/nextjs': minor
---

Implement token signature verification when passing verified token from Next.js middleware to the application origin.

13 changes: 13 additions & 0 deletions
package-lock.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 2 additions & 0 deletions
packages/backend/src/constants.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,7 @@ export const JWKS_CACHE_TTL_MS = 1000 * 60 * 60;

const Attributes = {
 AuthToken: '__clerkAuthToken',
 AuthSignature: '__clerkAuthSignature',
 AuthStatus: '__clerkAuthStatus',
 AuthReason: '__clerkAuthReason',
 AuthMessage: '__clerkAuthMessage',
Expand All@@ -32,6 +33,7 @@ const QueryParameters = {

const Headers = {
 AuthToken: 'x-clerk-auth-token',
 AuthSignature: 'x-clerk-auth-signature',
 AuthStatus: 'x-clerk-auth-status',
 AuthReason: 'x-clerk-auth-reason',
 AuthMessage: 'x-clerk-auth-message',
Expand Down

1 change: 1 addition & 0 deletions
packages/fastify/src/__tests__/__snapshots__/constants.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ exports[`constants from environment variables 1`] = `
 "Accept": "accept",
 "AuthMessage": "x-clerk-auth-message",
 "AuthReason": "x-clerk-auth-reason",
 "AuthSignature": "x-clerk-auth-signature",
 "AuthStatus": "x-clerk-auth-status",
 "AuthToken": "x-clerk-auth-token",
 "Authorization": "authorization",
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -70,11 +70,13 @@
 "@clerk/backend": "1.0.0-beta.33",
 "@clerk/clerk-react": "5.0.0-beta.36",
 "@clerk/shared": "2.0.0-beta.21",
 "crypto-js": "4.2.0",
 "path-to-regexp": "6.2.1",
 "tslib": "2.4.1"
 },
 "devDependencies": {
 "@clerk/types": "4.0.0-beta.25",
 "@types/crypto-js": "4.2.2",
 "@types/node": "^18.17.0",
 "@types/react": "*",
 "@types/react-dom": "*",
Expand Down

25 changes: 23 additions & 2 deletions
packages/nextjs/src/server/__tests__/createGetAuth.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
import { AuthStatus, constants } from '@clerk/backend/internal';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import { NextRequest } from 'next/server';

import { createGetAuth, getAuth } from '../createGetAuth';

const mockSecretKey = 'sk_test_mock';

// { alg: 'HS256' }.{ sub: 'user-id' }.sig
const mockToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkIn0.0u5CllULtDVD9DUUmUMdJLbBCSNcnv4j3hCaPz4dNr8';
// { alg: 'HS256' }.{ sub: 'user-id-2' }.sig
const mockToken2 = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyLWlkLTIifQ.K-mhz0Ber1Hfh2xCwmvsLwhZO_IKLtKt78KTHsecEas';

const mockTokenSignature = hmacSHA1(mockToken, 'sk_test_mock').toString();

describe('createGetAuth(opts)', () => {
 it('returns a getAuth function', () => {
 expect(createGetAuth({ debugLoggerName: 'test', noAuthStatusMessage: 'test' })).toBeInstanceOf(Function);
Expand All@@ -20,12 +25,13 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('parses and returns the token claims when signed out', () => {
Expand All@@ -45,13 +51,14 @@ describe('getAuth(req)', () => {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 Cookie: `__session=${mockToken2};`,
 }),
 });

 expect(getAuth(req).userId).toEqual('user-id');
 expect(getAuth(req, { secretKey: mockSecretKey }).userId).toEqual('user-id');
 });

 it('throws if auth status is not found', () => {
Expand All@@ -63,4 +70,18 @@ describe('getAuth(req)', () => {

 expect(() => getAuth(req)).toThrowError();
 });

 it('throws if signature does not match token', () => {
 const req = new NextRequest('https://www.clerk.com', {
 headers: new Headers({
 [constants.Headers.AuthStatus]: AuthStatus.SignedIn,
 [constants.Headers.AuthToken]: mockToken2,
 [constants.Headers.AuthSignature]: mockTokenSignature,
 [constants.Headers.AuthMessage]: 'message',
 [constants.Headers.AuthReason]: 'reason',
 }),
 });

 expect(() => getAuth(req, { secretKey: mockSecretKey })).toThrowError();
 });
});

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/authMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ const authMiddleware: AuthMiddleware = (...args: unknown[]) => {
 logger.debug(`Added ${constants.Headers.EnableDebug} on request`);
 }

 const result = decorateRequest(clerkRequest, finalRes, requestState) || NextResponse.next();
 const result = decorateRequest(clerkRequest, finalRes, requestState, secretKey) || NextResponse.next();

 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
Expand Down

2 changes: 1 addition & 1 deletion
packages/nextjs/src/server/clerkMiddleware.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -130,7 +130,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
 setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });
 }

 decorateRequest(clerkRequest, handlerResult, requestState);
 decorateRequest(clerkRequest, handlerResult, requestState, options.secretKey);

 // TODO @nikos: we need to make this more generic
 // and move the logic in clerk/backend
Expand Down

5 changes: 4 additions & 1 deletion
packages/nextjs/src/server/createGetAuth.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import { withLogger } from '../utils/debugLogger';
import { API_URL, API_VERSION, SECRET_KEY } from './constants';
import { getAuthAuthHeaderMissing } from './errors';
import type { RequestLike } from './types';
import { getAuthKeyFromRequest, getCookie, getHeader } from './utils';
import { assertTokenSignature, getAuthKeyFromRequest, getCookie, getHeader } from './utils';

export const createGetAuth = ({
 noAuthStatusMessage,
Expand All@@ -25,6 +25,7 @@ export const createGetAuth = ({
 // Then, we don't have to re-verify the JWT here,
 // we can just strip out the claims manually.
 const authToken = getAuthKeyFromRequest(req, 'AuthToken');
 const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');
 const authMessage = getAuthKeyFromRequest(req, 'AuthMessage');
 const authReason = getAuthKeyFromRequest(req, 'AuthReason');
 const authStatus = getAuthKeyFromRequest(req, 'AuthStatus') as AuthStatus;
Expand All@@ -46,6 +47,8 @@ export const createGetAuth = ({
 logger.debug('Options debug', options);

 if (authStatus === AuthStatus.SignedIn) {
 assertTokenSignature(authToken as string, options.secretKey, authSignature);

 const jwt = decodeJwt(authToken as string);

 logger.debug('JWT debug', jwt.raw.text);
Expand Down

2 changes: 2 additions & 0 deletions
packages/nextjs/src/server/errors.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -95,3 +95,5 @@ ${[apiRoutesText, publicRoutesText, ignoredRoutesText, afterAuthText]
For additional information about middleware, please visit https://clerk.com/docs/nextjs/middleware
(This log only appears in development mode, or if \`debug: true\` is passed to authMiddleware)`;
};

export const authSignatureInvalid = `Clerk: Unable to verify request, this usually means the Clerk middleware did not run. Ensure Clerk's middleware is properly integrated and matches the current route. For more information, see: https://clerk.com/docs/nextjs/middleware. (code=auth_signature_invalid)`;

32 changes: 30 additions & 2 deletions
packages/nextjs/src/server/utils.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,12 +3,13 @@ import { constants } from '@clerk/backend/internal';
import { handleValueOrFn } from '@clerk/shared/handleValueOrFn';
import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
import { isHttpOrHttps } from '@clerk/shared/proxy';
import hmacSHA1 from 'crypto-js/hmac-sha1';
import type { NextRequest } from 'next/server';
import { NextResponse } from 'next/server';

import { constants as nextConstants } from '../constants';
import { DOMAIN, IS_SATELLITE, PROXY_URL, SECRET_KEY, SIGN_IN_URL } from './constants';
import { missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import { authSignatureInvalid, missingDomainAndProxy, missingSignInUrlInDev } from './errors';
import type { RequestLike } from './types';

export function setCustomAttributeOnRequest(req: RequestLike, key: string, value: string): void {
Expand DownExpand Up@@ -108,7 +109,12 @@ export const injectSSRStateIntoObject = <O, T>(obj: O, authObject: T) => {
};

// Auth result will be set as both a query param & header when applicable
export function decorateRequest(req: ClerkRequest, res: Response, requestState: RequestState): Response {
export function decorateRequest(
 req: ClerkRequest,
 res: Response,
 requestState: RequestState,
 secretKey: string,
): Response {
 const { reason, message, status, token } = requestState;
 // pass-through case, convert to next()
 if (!res) {
Expand DownExpand Up@@ -145,6 +151,7 @@ export function decorateRequest(req: ClerkRequest, res: Response, requestState:
 setRequestHeadersOnNextResponse(res, req, {
 [constants.Headers.AuthStatus]: status,
 [constants.Headers.AuthToken]: token || '',
 [constants.Headers.AuthSignature]: token ? createTokenSignature(token, secretKey) : '',
 [constants.Headers.AuthMessage]: message || '',
 [constants.Headers.AuthReason]: reason || '',
 [constants.Headers.ClerkUrl]: req.clerkUrl.toString(),
Expand DownExpand Up@@ -206,3 +213,24 @@ export function assertKey(key: string, onError: () => never): string {

 return key;
}

/**
 * Compute a cryptographic signature from a session token and provided secret key. Used to validate that the token has not been modified when transferring between middleware and the Next.js origin.
 */
function createTokenSignature(token: string, key: string): string {
 return hmacSHA1(token, key).toString();
}

/**
 * Assert that the provided token generates a matching signature.
 */
export function assertTokenSignature(token: string, key: string, signature?: string | null) {
 if (!signature) {
 throw new Error(authSignatureInvalid);
 }

 const expectedSignature = createTokenSignature(token, key);
 if (expectedSignature !== signature) {
 throw new Error(authSignatureInvalid);
 }
}