Skip to content

Comments

Remove check for JWT typ header#4350

Closed
scottanderson wants to merge 2 commits intocolinhacks:mainfrom
scottanderson:typ
Closed

Remove check for JWT typ header#4350
scottanderson wants to merge 2 commits intocolinhacks:mainfrom
scottanderson:typ

Conversation

@scottanderson
Copy link

@scottanderson scottanderson commented May 11, 2025 •
edited by coderabbitai bot
Loading

Per RFC 7519, JWT implementations are required to ignore the typ header:

  • The typ header will typically not be used when it is already known that the object is a JWT.
  • This parameter is ignored by JWT implementations.
  • Use of this Header Parameter is OPTIONAL.

5.1. "typ" (Type) Header Parameter

The "typ" (type) Header Parameter defined by [JWS] and [JWE] is used
by JWT applications to declare the media type [IANA.MediaTypes] of
this complete JWT. This is intended for use by the JWT application
when values that are not JWTs could also be present in an application
data structure that can contain a JWT object; the application can use
this value to disambiguate among the different kinds of objects that
might be present. It will typically not be used by applications when
it is already known that the object is a JWT. This parameter is
ignored by JWT implementations; any processing of this parameter is
performed by the JWT application. If present, it is RECOMMENDED that
its value be "JWT" to indicate that this object is a JWT. While
media type names are not case sensitive, it is RECOMMENDED that "JWT"
always be spelled using uppercase characters for compatibility with
legacy implementations. Use of this Header Parameter is OPTIONAL.

Summary by CodeRabbit

Summary by CodeRabbit

  • Bug Fixes
    • Improved JWT validation to be less restrictive, allowing tokens without the typ property in their header.

@scottanderson
Remove check for JWT typ header
979f373 
Per RFC 7519, JWT implementations are required to ignore the typ header:

5.1.  "typ" (Type) Header Parameter

   The "typ" (type) Header Parameter defined by [JWS] and [JWE] is used
   by JWT applications to declare the media type [IANA.MediaTypes] of
   this complete JWT.  This is intended for use by the JWT application
   when values that are not JWTs could also be present in an application
   data structure that can contain a JWT object; the application can use
   this value to disambiguate among the different kinds of objects that
   might be present.  It will typically not be used by applications when
   it is already known that the object is a JWT.  This parameter is
   ignored by JWT implementations; any processing of this parameter is
   performed by the JWT application.  If present, it is RECOMMENDED that
   its value be "JWT" to indicate that this object is a JWT.  While
   media type names are not case sensitive, it is RECOMMENDED that "JWT"
   always be spelled using uppercase characters for compatibility with
   legacy implementations.  Use of this Header Parameter is OPTIONAL.
@netlify
Copy link

netlify bot commented May 11, 2025 •
edited
Loading

✅ Deploy Preview for guileless-rolypoly-866f8a ready!

Built without sensitive environment variables

Name Link
🔨 Latest commit b97d9ad
🔍 Latest deploy log https://app.netlify.com/sites/guileless-rolypoly-866f8a/deploys/6821d581f9939c00087574e5
😎 Deploy Preview https://deploy-preview-4350--guileless-rolypoly-866f8a.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented May 11, 2025 •
edited
Loading

Walkthrough

The update tweaks the internal logic of the isValidJWT function by dropping the requirement to check for the typ property in the JWT header. Now, the function only verifies the presence of the alg property when validating a JWT. No public interfaces or exports were changed.

Changes

File(s) Change Summary
deno/lib/types.ts, src/types.ts Modified isValidJWT to remove the check for the typ property in JWT header.

Poem

A JWT check, now lighter and neat,
No more fussing over typ in the seat.
Just alg is enough for the pass,
Making the logic a little more class.
Simpler code, a smoother ride—
JWTs now validated with less to decide!
🚀

Tip

⚡️ Faster reviews with caching
  • CodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure Review - Disable Cache at either the organization or repository level. If you prefer to disable all data retention across your organization, simply turn off the Data Retention setting under your Organization Settings.

Enjoy the performance boost—your workflow just got faster.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 979f373 and b97d9ad.

📒 Files selected for processing (1)
  • src/types.ts (1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
  • GitHub Check: Test with Deno v1.x
🔇 Additional comments (1)
src/types.ts (1)

744-761: Correct implementation according to JWT spec 👍

The removal of the typ check in the isValidJWT function makes the implementation more compliant with the JWT specification (RFC 7519). According to the spec, while the typ header can be included, JWT implementations should ignore this parameter.

This change properly focuses validation on what's actually required by the spec - the presence of the alg parameter.

✨ Finishing Touches
  • 📝 Generate Docstrings
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@scottanderson scottanderson mentioned this pull request May 11, 2025
Closed
@scottanderson
Copy link
Author

scottanderson commented May 11, 2025

Fixes #4049

@colinhacks
Copy link
Owner

colinhacks commented May 18, 2025

Thanks for this PR. This'll land in Zod 3.25. I've implemented this fix over in the v4 branch which is where active development is now happening (including for Zod 3): #4404

@colinhacks colinhacks mentioned this pull request May 18, 2025
Merged
@colinhacks colinhacks closed this May 18, 2025
@scottanderson scottanderson deleted the typ branch May 19, 2025 01:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@scottanderson @colinhacks