how to recognized jwt token from different tenant nestjs muti-tenant jwt - jwt

Question

I implement multi-tenant by multiple databases and use jwt token as authorization, my concern is that when user 1 of tenant 2 login and get the jwt token, when he uses to token to access another tenant, does he recognized as user 1 of tenant 2? If so, how can we fix it?
My Strategy
jwt.strategy.ts
#Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
constructor(
private readonly configService: ConfigService,
private readonly moduleRef: ModuleRef,
) {
super({
jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
passReqToCallback: true,
secretOrKey: configService.get('JWT_SECRET_KEY'),
});
}
async validate(request: Request, jwtPayload: JwtPayload) {
const contextId = ContextIdFactory.getByRequest(request);
const authService: AuthService = await this.moduleRef.resolve(
AuthService,
contextId,
);
let { iat, exp } = jwtPayload;
const timeDiff = exp - iat;
if (timeDiff <= 0) {
throw new UnauthorizedException();
}
return jwtPayload;
}
}
My Auth Service
auth.service.ts
#Injectable({ scope: Scope.REQUEST })
export class AuthService {
constructor(
private readonly jwtService: JwtService,
private readonly configService: ConfigService,
private readonly userService: UsersService,
private readonly auctionHouseService: AuctionHouseService,
) {}
async createToken(user: User) {
let plainUser: any = Object.assign({}, user);
plainUser.auctionHouseId = (
await this.auctionHouseService.getCurrentAuctionHouse()
).id;
return {
expiresIn: this.configService.get('JWT_EXPIRATION_TIME'),
accessToken: this.jwtService.sign(plainUser),
};
}
}
My Login controller
auth.controller.ts
#Controller('api/auth')
#ApiUseTags('authentication')
export class AuthController {
constructor(
private readonly authService: AuthService,
private readonly userService: UsersService,
) {}
#Post('login')
#ApiResponse({ status: 201, description: 'Successful Login' })
#ApiResponse({ status: 400, description: 'Bad Request' })
#ApiResponse({ status: 401, description: 'Unauthorized' })
async login(#Body() payload: LoginPayload, #Req() req): Promise<any> {
let user = await this.authService.validateUser(payload);
return omitPassword(await this.authService.createToken(user));
}

Answer 1

In general, the correct way to identify the domain within which a JWT is valid is the aud (or audience) field. Per RFC7519:
The "aud" (audience) claim identifies the recipients that the JWT is
intended for. Each principal intended to process the JWT MUST
identify itself with a value in the audience claim. If the principal
processing the claim does not identify itself with a value in the
"aud" claim when this claim is present, then the JWT MUST be
rejected. In the general case, the "aud" value is an array of case-
sensitive strings, each containing a StringOrURI value. In the
special case when the JWT has one audience, the "aud" value MAY be a
single case-sensitive string containing a StringOrURI value. The
interpretation of audience values is generally application specific.
Use of this claim is OPTIONAL.
In your context, you'd want to select unique audiences for each of your tenants (let's say it's tenant1 and tenant2) and when generating your JWT you'd do something like this:
plainUser.aud = this.configService.get("JWT_TENANT")
When verifying the token, you would then introduce a check which confirms that the aud claim matches the current tenant.
let { iat, exp, aud } = jwtPayload;
if (aud !== this.configService.get("JWT_TENANT")) {
throw new UnauthorizedException();
}
// The rest of your validation code
NOTE I'm assuming you would run multiple application instances of your application with different configurations for each tenant, however if tenants are derived elsewhere then you should gather that information from the relevant data source instead.
Approaching it this way will ensure that you can identify the user and tenant that the user belongs to and prevent tokens from tenant1 being used to access tenant2.