Secure backend JWT verification using Supabase JWKS signature validation

main.py

@@ -6,6 +6,7 @@ from pydantic import BaseModel
 from dotenv import load_dotenv
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 import jwt
+from jwt import PyJWKClient
 import base64
 from slowapi import Limiter, _rate_limit_exceeded_handler
 from slowapi.util import get_remote_address
@@ -38,21 +39,32 @@ RAZORPAY_PRO_PLAN_ID = os.getenv("RAZORPAY_PRO_PLAN_ID")
 razorpay_client = razorpay.Client(auth=(RAZORPAY_KEY_ID or "", RAZORPAY_KEY_SECRET or ""))
 
 
+SUPABASE_URL = os.getenv("SUPABASE_URL")
+JWKS_URL = f"{SUPABASE_URL}/auth/v1/.well-known/jwks.json" if SUPABASE_URL else ""
+jwks_client = PyJWKClient(JWKS_URL) if JWKS_URL else None
+
 security = HTTPBearer()
 
 def verify_token(credentials: HTTPAuthorizationCredentials = Depends(security)):
     token = credentials.credentials
     try:
+        if not jwks_client:
+            raise ValueError("SUPABASE_URL is not set.")
+            
+        signing_key = jwks_client.get_signing_key_from_jwt(token)
         payload = jwt.decode(
             token,
-            options={"verify_signature": False}
+            signing_key.key,
+            algorithms=["HS256", "RS256"],
+            audience="authenticated",
+            options={"verify_aud": True}
         )
         user_id = payload.get("sub")
         if not user_id:
-            raise HTTPException(status_code=401, detail="Invalid token")
+            raise HTTPException(status_code=401, detail="Invalid token claims")
         return user_id
-    except Exception:
-        raise HTTPException(status_code=401, detail="Invalid or expired token")
+    except Exception as e:
+        raise HTTPException(status_code=401, detail=f"Invalid or expired token: {str(e)}")
 
 INJECTION_PATTERNS = [
     r"ignore\s*(all\s*)?(previous|prior|above)\s*(instructions?|prompts?|context)",

requirements.txt

@@ -5,4 +5,5 @@ groq
 supabase
 razorpay>=1.3.0
 PyJWT
+cryptography
 slowapi>=0.1.9