JWT verification middleware spec
You're asking an AI agent to write a Node/TypeScript middleware that verifies incoming JWTs issued by your identity provider and authorizes requests. Write the spec that makes verification actually secure. What checks, algorithm policy, and key handling do you mandate, and what acceptance criteria prove a forged token is rejected? Then describe the specific, well-known vulnerability a naive prompt ('verify the JWT and read the user from it') tends to introduce.
verify_jwt_tokens(tokens: list[str], allowed_algs: list[str], trusted_kids: list[str], expected_issuer: str, expected_audience: str, now_epoch: int, skew_seconds: int) → list[str][["RS256|k1|1|https://idp.example.com|api://orders|2000|1000","none|k1|1|https://idp.example.com|api://orders|2000|1000","HS256|k1|1|https://idp.example.com|api://orders|2000|1000"],["RS256"],["k1","k2"],"https://idp.example.com","api://orders",1500,60]out["ok","alg_rejected","alg_rejected"][["RS256|k9|1|https://idp.example.com|api://orders|2000|1000","RS256|k1|0|https://idp.example.com|api://orders|2000|1000","RS256|k1|1|https://evil.example.com|api://orders|2000|1000","RS256|k1|1|https://idp.example.com|api://billing|2000|1000"],["RS256"],["k1","k2"],"https://idp.example.com","api://orders",1500,60]out["unknown_key","bad_signature","wrong_issuer","wrong_audience"]Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.
Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.