Validate JWTs on gRPC service calls #69

New issue

Closed

opened 2026-03-03 15:18:21 -08:00 by fable · 0 comments

fable commented

2026-03-03 15:18:21 -08:00

Contributor

Add a tonic interceptor that validates the microclimate JWT on incoming channel service calls and rejects unauthenticated requests.

The interceptor should:

Extract the Authorization: Bearer header from incoming metadata
Verify the JWT signature against JWT_SECRET
Reject expired tokens with an UNAUTHENTICATED status
Attach the verified DID to the request context so handlers can use it without re-parsing the token

Once this is in place, username can be removed from GetChannelTokenRequest—the server will source identity from the validated token rather than trusting a client-supplied value (see comment on #9).

Related to #9.

Add a tonic interceptor that validates the microclimate JWT on incoming channel service calls and rejects unauthenticated requests. The interceptor should: - Extract the Authorization: Bearer <token> header from incoming metadata - Verify the JWT signature against JWT_SECRET - Reject expired tokens with an UNAUTHENTICATED status - Attach the verified DID to the request context so handlers can use it without re-parsing the token Once this is in place, username can be removed from `GetChannelTokenRequest`—the server will source identity from the validated token rather than trusting a client-supplied value (see comment on #9). Related to #9.