added message to catch machine token to user auth and added changeset

clerk · Jan 14, 2025 · ea44d14 · ea44d14
1 parent 89949d4
commit ea44d14
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/.changeset/thin-stingrays-run.md b/.changeset/thin-stingrays-run.md
@@ -0,0 +1,6 @@
+---
+'@clerk/backend': minor
+'@clerk/nextjs': minor
+---
+
+Added machine to machine auth
diff --git a/packages/backend/src/tokens/request.ts b/packages/backend/src/tokens/request.ts
@@ -449,6 +449,10 @@ ${error.getFullMessage()}`,
 
   async function authenticateRequestWithTokenInHeader() {
     const { sessionTokenInHeader } = authenticateContext;
+    const { data: decodeResult } = decodeJwt(sessionTokenInHeader!);
+    if (decodeResult?.payload.sub.startsWith('mch_')) {
+      return signedOut(authenticateContext, 'Machine tokens cannot be used to authenticate user requests');
+    }
 
     try {
       const { data, errors } = await verifyToken(sessionTokenInHeader!, authenticateContext);