🐛 Error: Missing `Audience` & `Issuer` in the verify token function

[jmarianom]

Greetings!

I have a problem with AuthX, it raises a exception with the error "Invalid audience" when I set the field "aud" in the token.

Valid token with "aud" (encoded with "HS256" and the same "secret key" of the example): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsImp0aSI6IjE4ZTRlOWVlLWQ3ZmQtNDQ4ZS04ZDc3LTQ4MTQ1MmVkNGViNSIsInR5cGUiOiJhY2Nlc3MiLCJmcmVzaCI6ZmFsc2UsImNzcmYiOiIiLCJpYXQiOjE3MjgzMjM1ODMsImV4cCI6MTczNTU4MTE4My4wMTE5MTksImF1ZCI6InRlc3RBcHAifQ.j_RA19QwFGhMQrVJ7dnrCm4D9RoOEVrgng_Vk0a9i5E

from fastapi import FastAPI, Depends, HTTPException
from authx import AuthX, AuthXConfig, RequestToken

app = FastAPI()

config = AuthXConfig(
     JWT_SECRET_KEY = "SECRET_KEY",
     JWT_ENCODE_AUDIENCE="testApp",
     JWT_DECODE_AUDIENCE="testApp"
)

auth = AuthX(config=config)
auth.handle_errors(app)        

@app.get("/protected", dependencies=[Depends(auth.get_token_from_request)])
def get_protected(token: RequestToken = Depends()):
     try:
          auth.verify_token(token=token)
          return {"message": "Hello world !"}
     except Exception as e:
          raise HTTPException(401, detail={"message": str(e)}) from e

When I introduce the token raises the exception. According to PyJWT, the problem seems to be due to the missing parameter "audience" when invoking the "decode" method jpadilla/pyjwt#120

Sorry for my English, I'm Spanish.

[yezz123]

Hello @jmarianom I checked the issue and its seems coming from the verify Function talking about here:

authx/authx/main.py

Lines 383 to 390 in fcce4bd

	return token.verify(
	key=self.config.public_key,
	algorithms=[self.config.JWT_ALGORITHM],
	verify_fresh=verify_fresh,
	verify_type=verify_type,
	verify_csrf=verify_csrf,
	)

We should add :

            audience=self.config.JWT_DECODE_AUDIENCE,
            issuer=self.config.JWT_DECODE_ISSUER,

and its will work good with this example you provide:

from fastapi import Depends, FastAPI, HTTPException

from authx import AuthX, AuthXConfig, RequestToken

app = FastAPI()

config = AuthXConfig(
     JWT_SECRET_KEY = "SECRET_KEY",
     JWT_ENCODE_AUDIENCE="testApp",
     JWT_DECODE_AUDIENCE="testApp"
)

auth = AuthX(config=config)
auth.handle_errors(app)

@app.get("/")
def get_root():
     return {"message": "Hello world !"}


@app.get("/protected", dependencies=[Depends(auth.get_token_from_request)])
def get_protected(token: RequestToken = Depends()):  # noqa: B008
     try:
          auth.verify_token(token=token)
          return {"message": "Hello world !"}
     except Exception as e:
          raise HTTPException(401, detail={"message": str(e)}) from e

if __name__ == "__main__":
     import uvicorn
     uvicorn.run(app, host="0.0.0.0", port=8000)

I will fix it and provide it in the upcoming release 🐛

Thanks for catching this 🚀