diff options
Diffstat (limited to 'packages/meshbay-common/src/meshbay_common/handshake.py')
| -rw-r--r-- | packages/meshbay-common/src/meshbay_common/handshake.py | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py index 73e0b2e..2393df1 100644 --- a/packages/meshbay-common/src/meshbay_common/handshake.py +++ b/packages/meshbay-common/src/meshbay_common/handshake.py @@ -63,6 +63,7 @@ from typing import Any, Protocol import jwt from meshbay_common import MNP_VERSION +from meshbay_common.tokens import MNP_AUD HANDSHAKE_PREFIX = b"meshbay:mnp:handshake:v1" CHALLENGE_PREFIX = b"meshbay:mnp:challenge:v1" @@ -274,8 +275,15 @@ def authorize_token( """ try: decoded = jwt.decode(token, hub_pk_pem, algorithms=["EdDSA"], - leeway=JWT_LEEWAY_SECONDS) + leeway=JWT_LEEWAY_SECONDS, + audience=MNP_AUD, + options={"require": ["exp", "sub", "scope"]}) except Exception as exc: + # An audience mismatch lands here too: a hub *session* token + # (aud=HUB_API_AUD) presented to a node is refused. That is the point — + # the credential a member hands a node must not be one that also opens + # the hub API (see meshbay_common.tokens). A member presents the + # short-lived MNP token instead. raise HandshakeError(f"Invalid JWT: {exc}") from exc # A node-scoped daemon token must not be usable as a client token (M9). |