Claude fedd559fd6 fix: pin JWT algorithm to HS256 and harden token security ...

- Add { algorithms: ['HS256'] } to all jwt.verify() calls to prevent
  algorithm confusion attacks (including the 'none' algorithm)
- Add { algorithm: 'HS256' } to all jwt.sign() calls for consistency
- Reduce OIDC token payload to only { id } (was leaking username, email, role)
- Validate OIDC redirect URI against APP_URL env var when configured
- Add startup warning when JWT_SECRET is auto-generated

https://claude.ai/code/session_01SoQKcF5Rz9Y8Nzo4PzkxY8

2026-03-31 00:33:53 +00:00

..

auth.ts

fix: pin JWT algorithm to HS256 and harden token security

2026-03-31 00:33:53 +00:00

mfaPolicy.ts

fix: pin JWT algorithm to HS256 and harden token security

2026-03-31 00:33:53 +00:00

tripAccess.ts

refactoring: TypeScript migration, security fixes,

2026-03-27 18:40:18 +01:00

validate.ts

refactoring: TypeScript migration, security fixes,

2026-03-27 18:40:18 +01:00