feat(cloudflare-access): Add audience (aud) validation and harden JWT verification#1805

Merged

yusukebe merged 44 commits intohonojs:mainfrom

gradyat:fix/cloudflare-access-aud-validation

Apr 12, 2026

Commits on Mar 17, 2026

feat(cloudflare-access): add optional audience (aud) validation to prevent cross-application token reuse

gradyat
and
claude
committed
fix(cloudflare-access): fix inverted JWKS cache invalidation logic

gradyat
and
claude
committed
fix(cloudflare-access): validate accessTeamName format

gradyat
and
claude
committed
fix(cloudflare-access): warn when aud parameter is omitted

gradyat
and
claude
committed
refactor(cloudflare-access): add proper type for JWT header

gradyat
and
claude
committed
fix(cloudflare-access): use proper base64url decoding for all JWT segments

gradyat
and
claude
committed
fix(cloudflare-access): validate JWT alg header is RS256

gradyat
and
claude
committed
fix(cloudflare-access): add runtime validation for decoded JWT payload

gradyat
and
claude
committed
fix(cloudflare-access): validate nbf (not before) claim

gradyat
and
claude
committed
fix(cloudflare-access): prevent information leakage in issuer error

gradyat
and
claude
committed
fix(cloudflare-access): normalize error message casing

gradyat
and
claude
committed
fix(cloudflare-access): fix test description typos and imports

gradyat
and
claude
committed
test(cloudflare-access): add tests for new security validations

gradyat
and
claude
committed
docs(cloudflare-access): update error table with new validation errors

gradyat
and
claude
committed
style(cloudflare-access): apply prettier formatting

gradyat
and
claude
committed
fix(cloudflare-access): make nbf optional in CloudflareAccessPayload type

gradyat
and
claude
committed
fix(cloudflare-access): reorder JWT validation for security and performance

gradyat
and
claude
committed
test(cloudflare-access): clean up test helpers and improve test isolation

gradyat
and
claude
committed
test(cloudflare-access): add proper cache expiration test with fake timers

gradyat
and
claude
committed
fix(cloudflare-access): harden JWT parsing and JWKS key filtering

gradyat
and
claude
committed
fix(cloudflare-access): add key_ops filtering and missing kid guard per RFC 7517

gradyat
and
claude
committed
fix(cloudflare-access): make CloudflareAccessPayload fields accurately optional

gradyat
and
claude
committed
fix(cloudflare-access): harden aud validation against substring matching

gradyat
and
claude
committed
fix(cloudflare-access): validate base64url input per RFC 7515 §5.2

gradyat
and
claude
committed
fix(cloudflare-access): add 30-second clock skew tolerance for exp and nbf

gradyat
and
claude
committed
fix(cloudflare-access): re-fetch JWKS on kid cache miss for key rotation

gradyat
and
claude
committed
feat(cloudflare-access): accept multiple audiences in aud parameter

gradyat
and
claude
committed
style(cloudflare-access): run prettier
gradyat
committed
docs(cloudflare-access): add missing "Unsupported critical extension" error to README

gradyat
and
claude
committed
test(cloudflare-access): fix TypeScript type error in test payload assertion

gradyat
and
claude
committed

Commits on Mar 20, 2026

Commits on Mar 21, 2026

test(cloudflare-access): add coverage for base64urlDecodeToBytes invalid input

gradyat
and
claude
committed