fix(backend): Reject JWT-template tokens on the acceptsToken any/array header path (#9511)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: dominic-clerk

.changeset/reject-jwt-template-accepts-token-any.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Reject JWT-template tokens presented as session tokens in the `Authorization` header when `acceptsToken` is `'any'` or an array that includes `'session_token'`. `authenticateRequest()` now returns a signed-out state with reason `token-type-mismatch` for such a token, matching the existing `acceptsToken: 'session_token'` behavior.

packages/backend/src/tokens/__tests__/request.test.ts

@@ -1310,25 +1310,33 @@ describe('tokens.authenticateRequest(options)', () => {
   // Regression tests for SEC-340. A JWT-template token is signed by the same instance key and
   // passes verifyToken(), but carries no `sid`, so it outlives revocation of the session that
   // minted it and must not authenticate one.
+  const templateInHeader = (jwt: string) => mockRequestWithHeaderAuth({ authorization: jwt });
   describe.each([
-    ['headerToken', (jwt: string) => mockRequestWithHeaderAuth({ authorization: jwt })],
+    ['headerToken', templateInHeader, {}],
     [
       'cookieToken',
       (jwt: string) =>
         mockRequestWithCookies(
           {},
           { __clerk_db_jwt: 'deadbeef', __client_uat: `${mockJwtPayload.iat - 10}`, __session: jwt },
         ),
+      {},
     ],
-  ])('%s: JWT-template token presented as a session token (SEC-340)', (_label, buildRequest) => {
+    ['headerToken, acceptsToken: any', templateInHeader, { acceptsToken: 'any' as const }],
+    [
+      'headerToken, acceptsToken: [session_token, m2m_token]',
+      templateInHeader,
+      { acceptsToken: ['session_token', 'm2m_token'] as const },
+    ],
+  ])('%s: JWT-template token presented as a session token (SEC-340)', (_label, buildRequest, options) => {
     test('returns signed out', async () => {
       const { sid: _sid, ...payloadWithoutSid } = mockJwtPayload;
       const { data: templateJwt } = await signJwt(payloadWithoutSid, signingJwks, {
         algorithm: 'RS256',
         header: { typ: 'JWT', kid: 'ins_2GIoQhbUpy0hX7B2cVkuTMinXoD', cat: JWT_CATEGORY_JWT_TEMPLATE },
       });
 
-      const requestState = await authenticateRequest(buildRequest(templateJwt!), mockOptions());
+      const requestState = await authenticateRequest(buildRequest(templateJwt!), mockOptions(options));
 
       expect(requestState).toBeSignedOut({
         reason: AuthErrorReason.TokenTypeMismatch,

packages/backend/src/tokens/request.ts

@@ -864,7 +864,16 @@ export const authenticateRequest: AuthenticateRequest = (async (
       });
     }
 
-    // Handle as a regular session token
+    // Handle as a regular session token. Mirrors the session-only header path (SEC-340).
+    if (hasNonSessionJwtCategory(tokenInHeader)) {
+      return signedOut({
+        tokenType: TokenType.SessionToken,
+        authenticateContext,
+        reason: AuthErrorReason.TokenTypeMismatch,
+        message: '',
+      });
+    }
+
     const { data, errors } = await verifyToken(tokenInHeader, authenticateContext);
     if (errors) {
       return handleSessionTokenError(errors[0], 'header');