Add jwt #2
Add jwt #2
Conversation
There was a problem hiding this comment.
Pull request overview
This PR replaces insecure cookie-based session storage with JWT tokens to improve security. Session data is now stored as signed JWT tokens using the jose library with the HS512 algorithm, requiring a new JWT_SECRET environment variable when OIDC authentication is enabled.
Key Changes
- Implemented JWT-based authentication using the
joselibrary (v6.1.2) with HS512 signing algorithm - Added
createJWT()function to generate signed tokens and updatedgetAuthSession()to validate them - Made
JWT_SECRETa required environment variable when OIDC is enabled
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| src/lib/auth.ts | Added JWT token creation and verification logic, updated session validation to use JWT tokens instead of plain JSON |
| src/routes/api/auth/callback.tsx | Updated callback handler to generate JWT tokens for authenticated sessions |
| package.json | Added jose v6.1.2 as a new dependency for JWT token operations |
| env.example | Added JWT_SECRET configuration example for JWT signing |
| RELEASE_NOTES.md | Documented security improvements, breaking changes, and technical implementation details |
| README.md | Added comprehensive documentation for JWT_SECRET including generation instructions and updated authentication requirements |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- Added Zod for JWT payload validation. - Introduced functions to manage JWT expiration and secure cookie settings. - Updated README to reflect changes in JWT secret generation requirements. - Modified session cookie handling to include secure flag based on HTTPS. - Updated dependencies to use Zod version 4.1.13.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 8 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
🔒 Security Fixes
joselibrary with HS512 algorithmJWT_SECRETenvironment variableJWT_SECRETis used to sign and verify JWT tokens for user sessionsJWT_SECRETconfigured📝 Documentation
🔧 Technical Changes
joselibrary to version 6.1.2getAuthSession()to validate JWT tokenscreateJWT()function for token generation