How to properly verify auth token in forge remote?

Forge
, , ,
1

Hello, I am new to forge remote and currently following the steps on verifying remote requests here:

I implemented the same on our app but is receiving an error on jose.jwtVerify:

image
image1157×211 37.6 KB

I’d like to know if there’s anything I’m missing or if there’s an incorrect part.
I’m using the latest forge cli and also the latest jose.

Here are my validation codes:

const validateAuthHeader = async (authHeader, appId) => {
  let forgeInvocationToken;
  if (authHeader?.startsWith("Bearer")) {
    [, forgeInvocationToken] = authHeader.split(" ");
  }

  if (!forgeInvocationToken) {
    throw new Error("No valid auth token provided in the request");
  }

  console.log("FIT: ", forgeInvocationToken);

  const jwksUrl =
    "https://forge.cdn.prod.atlassian-dev.net/.well-known/jwks.json";

  const JWKS = jose.createRemoteJWKSet(new URL(jwksUrl));
  console.log("JWKS: ", JWKS);

  const options = {
    audience: appId,
    issuer: "forge/invocation-token",
  };

  const { payload } = await jose
    .jwtVerify(forgeInvocationToken, JWKS, options)
    .catch(async (error) => {
      throw error;
    });

  console.log("PAYLOAD: ", payload);
  return payload;
};
2

Hi @DarylLim, that’s interesting. It seems like your application gets a non 200 back from our JWKS endpoint (https://forge.cdn.prod.atlassian-dev.net/.well-known/jwks.json). Are you able to try request that endpoint directly using a client (node-fetch, axios … etc) and see if you get an error back.

3

Hello @BoZhang, I tried to request directly using client fetch and it works just fine.

I tried this one:

const jwksUrl ="https://forge.cdn.prod.atlassian-dev.net/.well-known/jwks.json";
const testfetch = await fetch(jwksUrl);
const response = await testfetch.json();

I got the proper results which is equivalent to the keys on the json.

4

Hmm, where is your remote server running and what version of Node.js are you on?
The error that you are seeing seems to come from here. If you are running your server locally, you could potentially tweak that file to log out the status code and body to see if we can find any more clues.

5

I’m trying to use a webtrigger as my remote endpoint and see if I can do forge remote features without using another server. Maybe that’s why I am getting the error. I am using node version 18.18.0 by the way.

Maybe I’m doing a wrong approach. The reason why I tried this is because we want to use the app permissions without using another server. Hence, tried using the webtriggers. However, when api.asApp is used on webtrigger, I am getting error 401 unauthorized. I’m having a hard time finding some docs/topics/samples regarding on how to create/verify authorization on webtriggers since when calling it through fetch, it has no authorization on the headers. That’s why I switched on making it a remote endpoint. Do you have any suggestions on this?

I’ve also tried invoking resolver but it has some limitations that becomes a blocker.

6

Ahh I see, if you are trying to hit the JWKS endpoint directly from a Forge Webtrigger, then you need to add the JWKS URL in the egress permissions. I am kind of surprised that the code snippet you attached works in the web-trigger.

I’ve also tried invoking resolver but it has some limitations that becomes a blocker.

Can you please explain these limitations? If possible, it would be ideal to go through a resolver rather than using a remote.

7

Hi @BoZhang, tried to add it on the egress permissions and it worked. Although I have a different error now (I’ll research and investigate the cause of this one):

image
image1134×170 27.1 KB

Can you please explain these limitations? If possible, it would be ideal to go through a resolver rather than using a remote.

About this one, I’m trying to send some files but when I tried it on adding to the payload of invoke, it doesn’t seem to push through on larger files. (I’m not sure but I think it is related to graphQL. this was our blocker before that’s why we changed approach)

8

For that error, please make sure that the appId that you verify against the audience claim is in format ari:cloud:ecosystem::app/{id-in-your-manifest}.

I’m trying to send some files but when I tried it on adding to the payload of invoke, it doesn’t seem to push through on larger files. (I’m not sure but I think it is related to graphQL. this was our blocker before that’s why we changed approach)

Can you please elaborate a bit more on what you are trying to achieve with the handling of these files and the error that you are seeing? In addition, using Forge remote and Webtriggers doesn’t evade GraphQL, these are used under the hood for both capabilities, they are just abstracted away.

1 Like
9

Hi @BoZhang I DMed you with details of what Daryl is working on

1 Like