fix(realtime): prevent sending expired tokens (#618)

* fix(realtime): prevent sending expired tokens

* fix test

* test

* remove jwt-kit

* update packages

Author: grdsdev

Sources/Auth/AuthClient.swift

@@ -861,7 +861,7 @@ public final class AuthClient: Sendable {
     var hasExpired = true
     var session: Session
 
-    let jwt = try decode(jwt: accessToken)
+    let jwt = JWT.decodePayload(accessToken)
     if let exp = jwt?["exp"] as? TimeInterval {
       expiresAt = Date(timeIntervalSince1970: exp)
       hasExpired = expiresAt <= now

Sources/Auth/AuthMFA.swift

@@ -125,7 +125,7 @@ public struct AuthMFA: Sendable {
   public func getAuthenticatorAssuranceLevel() async throws -> AuthMFAGetAuthenticatorAssuranceLevelResponse {
     do {
       let session = try await sessionManager.session()
-      let payload = try decode(jwt: session.accessToken)
+      let payload = JWT.decodePayload(session.accessToken)
 
       var currentLevel: AuthenticatorAssuranceLevels?
 

Sources/Auth/Internal/Helpers.swift

@@ -39,33 +39,3 @@ private func extractParams(from fragment: String) -> [URLQueryItem] {
           : nil
       }
 }
-
-func decode(jwt: String) throws -> [String: Any]? {
-  let parts = jwt.split(separator: ".")
-  guard parts.count == 3 else {
-    return nil
-  }
-
-  let payload = String(parts[1])
-  guard let data = base64URLDecode(payload) else {
-    return nil
-  }
-  let json = try JSONSerialization.jsonObject(with: data, options: [])
-  guard let decodedPayload = json as? [String: Any] else {
-    return nil
-  }
-  return decodedPayload
-}
-
-private func base64URLDecode(_ value: String) -> Data? {
-  var base64 = value.replacingOccurrences(of: "-", with: "+")
-    .replacingOccurrences(of: "_", with: "/")
-  let length = Double(base64.lengthOfBytes(using: .utf8))
-  let requiredLength = 4 * ceil(length / 4.0)
-  let paddingLength = requiredLength - length
-  if paddingLength > 0 {
-    let padding = "".padding(toLength: Int(paddingLength), withPad: "=", startingAt: 0)
-    base64 = base64 + padding
-  }
-  return Data(base64Encoded: base64, options: .ignoreUnknownCharacters)
-}

Sources/Helpers/JWT.swift

@@ -0,0 +1,40 @@
+//
+//  JWT.swift
+//  Supabase
+//
+//  Created by Guilherme Souza on 28/11/24.
+//
+
+import Foundation
+
+package enum JWT {
+  package static func decodePayload(_ jwt: String) -> [String: Any]? {
+    let parts = jwt.split(separator: ".")
+    guard parts.count == 3 else {
+      return nil
+    }
+
+    let payload = String(parts[1])
+    guard let data = base64URLDecode(payload) else {
+      return nil
+    }
+    let json = try? JSONSerialization.jsonObject(with: data, options: [])
+    guard let decodedPayload = json as? [String: Any] else {
+      return nil
+    }
+    return decodedPayload
+  }
+
+  private static func base64URLDecode(_ value: String) -> Data? {
+    var base64 = value.replacingOccurrences(of: "-", with: "+")
+      .replacingOccurrences(of: "_", with: "/")
+    let length = Double(base64.lengthOfBytes(using: .utf8))
+    let requiredLength = 4 * ceil(length / 4.0)
+    let paddingLength = requiredLength - length
+    if paddingLength > 0 {
+      let padding = "".padding(toLength: Int(paddingLength), withPad: "=", startingAt: 0)
+      base64 = base64 + padding
+    }
+    return Data(base64Encoded: base64, options: .ignoreUnknownCharacters)
+  }
+}

Sources/Realtime/V2/RealtimeClientV2.swift

@@ -363,6 +363,14 @@ public final class RealtimeClientV2: Sendable {
   /// Sets the JWT access token used for channel subscription authorization and Realtime RLS.
   /// - Parameter token: A JWT string.
   public func setAuth(_ token: String?) async {
+    if let token, let payload = JWT.decodePayload(token),
+      let exp = payload["exp"] as? TimeInterval, exp < Date().timeIntervalSince1970
+    {
+      options.logger?.warning(
+        "InvalidJWTToken: Invalid value for JWT claim \"exp\" with value \(exp)")
+      return
+    }
+
     mutableState.withValue {
       $0.accessToken = token
     }

Supabase.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -1,13 +1,13 @@
 import XCTest
 
-@testable import Auth
+@testable import Helpers
 
 final class JWTTests: XCTestCase {
   func testDecodeJWT() throws {
     let token =
       "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJhdXRoZW50aWNhdGVkIiwiZXhwIjoxNjQ4NjQwMDIxLCJzdWIiOiJmMzNkM2VjOS1hMmVlLTQ3YzQtODBlMS01YmQ5MTlmM2Q4YjgiLCJlbWFpbCI6ImhpQGJpbmFyeXNjcmFwaW5nLmNvIiwicGhvbmUiOiIiLCJhcHBfbWV0YWRhdGEiOnsicHJvdmlkZXIiOiJlbWFpbCIsInByb3ZpZGVycyI6WyJlbWFpbCJdfSwidXNlcl9tZXRhZGF0YSI6e30sInJvbGUiOiJhdXRoZW50aWNhdGVkIn0.CGr5zNE5Yltlbn_3Ms2cjSLs_AW9RKM3lxh7cTQrg0w"
-    let jwt = try decode(jwt: token)
+    let jwt = JWT.decodePayload(token)
     let exp = try XCTUnwrap(jwt?["exp"] as? TimeInterval)
-    XCTAssertEqual(exp, 1648640021)
+    XCTAssertEqual(exp, 1_648_640_021)
   }
 }

Tests/AuthTests/JWTTests.swift renamed to Tests/HelpersTests/JWTTests.swift

@@ -342,6 +342,27 @@ final class RealtimeTests: XCTestCase {
     }
   }
 
+  func testSetAuth() async {
+    let validToken =
+      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjY0MDkyMjExMjAwfQ.GfiEKLl36X8YWcatHg31jRbilovlGecfUKnOyXMSX9c"
+    await sut.setAuth(validToken)
+
+    XCTAssertEqual(sut.mutableState.accessToken, validToken)
+  }
+
+  func testSetAuthWithExpiredToken() async throws {
+    let expiredToken =
+      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOi02NDA5MjIxMTIwMH0.tnbZRC8vEyK3zaxPxfOjNgvpnuum18dxYlXeHJ4r7u8"
+    await sut.setAuth(expiredToken)
+
+    XCTAssertNotEqual(sut.mutableState.accessToken, expiredToken)
+  }
+
+  func testSetAuthWithNonJWT() async throws {
+    let token = "sb-token"
+    await sut.setAuth(token)
+  }
+
   private func connectSocketAndWait() async {
     ws.mockConnect(.connected)
     await sut.connect()