Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jedisct1 merged 3 commits into from
Jul 1, 2026
Merged

Accept SSO JWT audiences with or without a trailing slash #1837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
19589af
Accept SSO JWT audiences with or without a trailing slash
jedisct1 Jul 1, 2026
14afcd8
Add PR link
jedisct1 Jul 1, 2026
8d6466d
Add JWT relaxiation test
jedisct1 Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down
22 changes: 20 additions & 2 deletions pkg/auth/auth.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
return "", nil, errors.New("failed to extract aud from JWT claims")
}

if aud != s.APIEndpoint {
return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
return "", nil, err
}

email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
audString, ok := aud.(string)
if !ok {
return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
}

if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
}
return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
// The auth provider has returned audiences with and without a trailing slash
// for the same API endpoint. Accept either form for compatibility.
return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
ctx := context.Background()
Expand Down
100 changes: 100 additions & 0 deletions pkg/auth/auth_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
t.Parallel()

const apiEndpoint = "https://api.fastly.com"

tests := []struct {
name string
aud any
wantErr bool
}{
{
name: "exact match",
aud: apiEndpoint,
},
{
name: "trailing slash match",
aud: apiEndpoint + "/",
},
{
name: "different audience",
aud: "https://api.example.com/",
wantErr: true,
},
{
name: "non string audience",
aud: []string{apiEndpoint},
wantErr: true,
},
}

for _, tt := range tests {
tt := tt
t.Run(tt.name, func(t *testing.T) {
t.Parallel()

err := validateAudienceClaim(tt.aud, apiEndpoint)
if (err != nil) != tt.wantErr {
t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
}
})
}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
t.Parallel()

tests := []struct {
name string
aud string
apiEndpoint string
want bool
}{
{
name: "exact match without trailing slash",
aud: "https://api.fastly.com",
apiEndpoint: "https://api.fastly.com",
want: true,
},
{
name: "audience trailing slash accepted",
aud: "https://api.fastly.com/",
apiEndpoint: "https://api.fastly.com",
want: true,
},
{
name: "configured endpoint trailing slash accepted",
aud: "https://api.fastly.com",
apiEndpoint: "https://api.fastly.com/",
want: true,
},
{
name: "double trailing slash rejected",
aud: "https://api.fastly.com//",
apiEndpoint: "https://api.fastly.com",
want: false,
},
{
name: "different audience rejected",
aud: "https://example.com/",
apiEndpoint: "https://api.fastly.com",
want: false,
},
}

for _, tt := range tests {
tt := tt
t.Run(tt.name, func(t *testing.T) {
t.Parallel()

got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
if got != tt.want {
t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
}
})
}
}
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Accept SSO JWT audiences with or without a trailing slash#1837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jedisct1
merged 3 commits into

from

Jul 1, 2026
 Merged


Accept SSO JWT audiences with or without a trailing slash
#1837
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
19589af

Accept SSO JWT audiences with or without a trailing slash


jedisct1 Jul 1, 2026
14afcd8

Add PR link


jedisct1 Jul 1, 2026
8d6466d

Add JWT relaxiation test


jedisct1 Jul 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,8 @@

### Bug Fixes:

- fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. ([#1837](https://github.com/fastly/cli/pull/1837))

### Enhancements:

### Dependencies:
Expand Down

22 changes: 20 additions & 2 deletions
pkg/auth/auth.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -283,8 +283,8 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
 return "", nil, errors.New("failed to extract aud from JWT claims")
	}

	if aud != s.APIEndpoint {
 return "", nil, fmt.Errorf("failed to match expected aud: %s", s.APIEndpoint)
	if err := validateAudienceClaim(aud, s.APIEndpoint); err != nil {
 return "", nil, err
	}

	email, ok := claims["email"]
Expand All@@ -305,6 +305,24 @@ func (s *Server) ValidateAndRetrieveAPIToken(accessToken string) (string, *APITo
	return e, at, nil
}

func validateAudienceClaim(aud any, apiEndpoint string) error {
	audString, ok := aud.(string)
	if !ok {
 return fmt.Errorf("failed to type assert 'aud' (%#v) to a string", aud)
	}

	if !audienceMatchesAPIEndpoint(audString, apiEndpoint) {
 return fmt.Errorf("failed to match expected aud %q, got %q", apiEndpoint, audString)
	}
	return nil
}

func audienceMatchesAPIEndpoint(aud, apiEndpoint string) bool {
	// The auth provider has returned audiences with and without a trailing slash
	// for the same API endpoint. Accept either form for compatibility.
	return strings.TrimSuffix(aud, "/") == strings.TrimSuffix(apiEndpoint, "/")
}

// VerifyJWTSignature calls the jwks_uri endpoint and extracts its claims.
func (s *Server) VerifyJWTSignature(accessToken string) (claims map[string]any, err error) {
	ctx := context.Background()
Expand Down

100 changes: 100 additions & 0 deletions
pkg/auth/auth_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
package auth

import "testing"

func TestValidateAudienceClaim(t *testing.T) {
	t.Parallel()

	const apiEndpoint = "https://api.fastly.com"

	tests := []struct {
 name string
 aud any
 wantErr bool
	}{
 {
 name: "exact match",
 aud: apiEndpoint,
 },
 {
 name: "trailing slash match",
 aud: apiEndpoint + "/",
 },
 {
 name: "different audience",
 aud: "https://api.example.com/",
 wantErr: true,
 },
 {
 name: "non string audience",
 aud: []string{apiEndpoint},
 wantErr: true,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 err := validateAudienceClaim(tt.aud, apiEndpoint)
 if (err != nil) != tt.wantErr {
 t.Fatalf("validateAudienceClaim() error = %v, wantErr %t", err, tt.wantErr)
 }
 })
	}
}

func TestAudienceMatchesAPIEndpoint(t *testing.T) {
	t.Parallel()

	tests := []struct {
 name string
 aud string
 apiEndpoint string
 want bool
	}{
 {
 name: "exact match without trailing slash",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "audience trailing slash accepted",
 aud: "https://api.fastly.com/",
 apiEndpoint: "https://api.fastly.com",
 want: true,
 },
 {
 name: "configured endpoint trailing slash accepted",
 aud: "https://api.fastly.com",
 apiEndpoint: "https://api.fastly.com/",
 want: true,
 },
 {
 name: "double trailing slash rejected",
 aud: "https://api.fastly.com//",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
 {
 name: "different audience rejected",
 aud: "https://example.com/",
 apiEndpoint: "https://api.fastly.com",
 want: false,
 },
	}

	for _, tt := range tests {
 tt := tt
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()

 got := audienceMatchesAPIEndpoint(tt.aud, tt.apiEndpoint)
 if got != tt.want {
 t.Fatalf("audienceMatchesAPIEndpoint(%q, %q) = %t, want %t", tt.aud, tt.apiEndpoint, got, tt.want)
 }
 })
	}
}
Loading