5.2.0

Vapor JWT 5.2.0

Warning

⚠️ This is a security release. Update as soon as possible. ⚠️
Applications accepting provider identity tokens must also configure or pass their expected audience. Updating the package alone does not secure audience-free login paths.

This release requires JWTKit 5.8.0 and adds audience-aware verification and authentication APIs. It also raises the Swift tools version to 6.2.

Migrating provider logins

Set the client ID your application accepts (or the Firebase project ID) for each provider you use:

app.jwt.apple.applicationIdentifier = appleClientID
app.jwt.google.applicationIdentifier = googleServerClientID
app.jwt.microsoft.applicationIdentifier = microsoftClientID
app.jwt.firebaseAuth.applicationIdentifier = firebaseProjectID

You can instead pass an identifier at the call site:

let token = try await req.jwt.apple.verify(applicationIdentifier: appleClientID)

If an endpoint accepts multiple client IDs, pass expectedAudiences:

let token = try await req.jwt.google.verify(
    expectedAudiences: [webClientID, mobileClientID]
)

For the common Google mobile-plus-backend flow, verify the server client ID in aud. A mobile client ID in azp is not restricted by default; use trustedAuthorizedPresenters if your application needs that restriction.

Migrating generic verification and authenticators

Generic verification uses keys registered in app.jwt.keys:

let token = try await req.jwt.verify(
    as: AppleIdentityToken.self,
    expectedAudience: appleClientID
)

For an identity-token type that also conforms to Authenticatable, use authenticator(expectedAudience:) or authenticator(expectedAudiences:) instead of the no-argument authenticator. If you have a custom JWTAuthenticator for a provider token, replace it with an AsyncBearerAuthenticator that calls the provider helper with an expected audience:

struct AppleAuthenticator: AsyncBearerAuthenticator {
    let clientID: String

    func authenticate(bearer: BearerAuthorization, for request: Request) async throws {
        let token = try await request.jwt.apple.verify(
            bearer.token,
            applicationIdentifier: clientID
        )
        request.auth.login(AppleUser(subject: token.subject.value))
    }
}

Audience-free calls remain available for compatibility and log a runtime warning after successful verification. Concrete identity-token calls to req.jwt.verify(as:) and the no-argument authenticator() are deprecated. Calls through a generic JWTPayload constraint, including custom JWTAuthenticator implementations, cannot receive that compile-time warning. Do not use an audience-free result to log a user in.