fix: check verifierID in token before passing to customAuth

Web3Auth · Nov 21, 2024 · 919783e · 919783e
1 parent ed67ffa
commit 919783e
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/Sources/mpc-core-kit-swift/CoreKitError.swift b/Sources/mpc-core-kit-swift/CoreKitError.swift
@@ -30,6 +30,7 @@ public enum CoreKitError: Error {
     case noTssTags
     case invalidDeviceFactorKey
     case invalidTssPubKey
+    case mismatchedVerifierID
     case runtime(_ msg: String)
 
     public var errorDescription: String {
@@ -94,6 +95,8 @@ public enum CoreKitError: Error {
             return msg
         case .invalidTssPubKey:
             return "Invalid tss public key"
+        case .mismatchedVerifierID:
+            return "VerifierID field in idToken does not match verifierID"
         }
     }
 }
diff --git a/Sources/mpc-core-kit-swift/MpcCoreKitSwift.swift b/Sources/mpc-core-kit-swift/MpcCoreKitSwift.swift
@@ -111,11 +111,16 @@ public class MpcCoreKit {
 
     public func loginWithJwt(verifier: String, verifierId: String, idToken: String) async throws -> MpcKeyDetails {
 
+        let parsedToken = try decode(jwt: idToken)
+        let verifierIDToken = parsedToken.subject;
+
+        if verifierIDToken != verifierId {
+            throw CoreKitError.mismatchedVerifierID
+        }
+
         let torusKey = try await customAuth.getTorusKey(verifier: verifier, verifier_id: verifierId, verifierParams: VerifierParams(verifier_id: verifierId), idToken: idToken)
 
         let result = try await login(keyDetails: torusKey, verifier: verifier, verifierId: verifierId)
-
-        let parsedToken = try decode(jwt: idToken)
 
         // TODO: Make constructor public in customauth for TorusGenericContainer
         let encodedEmptyState = "7b22706172616d73223a7b7d7d"