fix(apple): validate id_token iss and aud on Sign in with Apple

After ParseWithClaims succeeded the Apple handler accepted any token Apple
had signed, regardless of which Sign-in-with-Apple client it was issued
to. The relying party MUST verify iss == https://appleid.apple.com and
aud == ClientID per Apple's spec; we did neither, which let an
attacker-controlled Sign-in-with-Apple client (or a sibling service in
the same Apple developer team) substitute its own id_token and
authenticate as the foreign sub.

Add validateAppleIDClaims helper, run it after ParseWithClaims, return
403 with "invalid id_token" on rejection. Same fix applied to v1
(github.com/golang-jwt/jwt v3.2.2 API: VerifyIssuer/VerifyAudience) and
v2 (jwt v5 API: GetIssuer/GetAudience), single PR.

Update the test fixture createTestResponseToken to use realistic iss/aud
so existing happy-path integration tests keep passing.

Tests:
* TestValidateAppleIDClaims -- table-driven coverage of the helper:
  wrong-iss, missing-iss, wrong-aud, missing-aud rejection (and
  audience-as-list match for v2).
* TestAppleHandler_LoginHandler_RejectsWrongIssuer -- integration
  regression test at the handler boundary. Drives the full exchange
  flow with a token signed by the test JWK but iss = attacker.example.com.
  With the fix in place the handler returns 403 invalid id_token; if
  the validateAppleIDClaims call site is reverted the foreign-iss
  token authenticates (200 with a JWT) and this test fails on the
  status-code assertion. The unit-level helper test alone wouldn't
  catch a missing call.

prepareAppleOauthTest gains an explicit testIDTokenOverride parameter
so the regression test can inject its own iss/aud while existing
callers keep their defaults.

Author: paskal

README.md

@@ -732,6 +732,15 @@ Then add an Apple provider that accepts the following parameters:
   Subsequent logins to your app using Sign In with Apple with the same account do not share any user info and will only return a user identifier in IDToken claims.
   This behaves correctly until a user delete sign in for you service with Apple ID in own Apple account profile (security section).
   It is recommend that you securely cache the at first login containing the user info for bind it with a user UID at next login.
+
+**Token validation:**
+
+The provider verifies the Apple `id_token` signature against Apple's published JWK, then enforces:
+
+* `iss == "https://appleid.apple.com"` -- per Apple's Sign-in-with-Apple [REST API spec](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user)
+* `aud == ClientID` (your Service ID or App ID)
+
+A token signed by Apple but issued for a different `aud` is rejected with `403 invalid id_token`. This prevents a confused-deputy attack where a sibling service in the same Apple developer team (or any other Sign-in-with-Apple client) could replay its own valid token against this service.
   Provider always get user `UID` (`sub` claim) in `IDToken`.
 
 * Apple doesn't have an API for fetch avatar and user info.

provider/apple.go

@@ -13,6 +13,7 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -354,6 +355,12 @@ func (ah AppleHandler) AuthHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err = validateAppleIDClaims(tokenClaims, ah.conf.ClientID); err != nil {
+		ah.Logf("[WARN] apple id_token rejected: %s", err.Error())
+		rest.SendErrorJSON(w, r, ah.L, http.StatusForbidden, nil, "invalid id_token")
+		return
+	}
+
 	u := ah.mapUser(tokenClaims)
 
 	u, err = setAvatar(ah.AvatarSaver, u, &http.Client{Timeout: 5 * time.Second})
@@ -544,3 +551,21 @@ func (ah AppleHandler) makeRedirURL(path string) string {
 
 	return strings.TrimRight(ah.URL, "/") + strings.TrimSuffix(newPath, "/") + urlCallbackSuffix
 }
+
+// appleIDTokenIssuer is the issuer Apple sets on every id_token issued by Sign in with Apple.
+// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user
+const appleIDTokenIssuer = "https://appleid.apple.com" // #nosec G101 -- public Apple issuer URL, not a credential
+
+// validateAppleIDClaims checks that the id_token claims have the expected Apple
+// issuer and that the audience matches the relying party's client ID. The signature
+// must already have been verified by the caller; this only catches confused-deputy
+// cases where another Apple-signed token is replayed against the wrong audience.
+func validateAppleIDClaims(claims jwt.MapClaims, expectedAud string) error {
+	if !claims.VerifyIssuer(appleIDTokenIssuer, true) {
+		return errors.New("invalid id_token issuer")
+	}
+	if !claims.VerifyAudience(expectedAud, true) {
+		return errors.New("invalid id_token audience")
+	}
+	return nil
+}

provider/apple_test.go

@@ -177,6 +177,51 @@ func TestAppleHandlerCreateClientSecret(t *testing.T) {
 	assert.Equal(t, "auth.example.com", testClaims["sub"])
 }
 
+func TestValidateAppleIDClaims(t *testing.T) {
+	const clientID = "auth.example.com"
+	tests := []struct {
+		name    string
+		claims  jwt.MapClaims
+		wantErr string
+	}{
+		{
+			name:   "valid iss and aud accepted",
+			claims: jwt.MapClaims{"iss": "https://appleid.apple.com", "aud": clientID, "sub": "u1"},
+		},
+		{
+			name:    "wrong issuer rejected",
+			claims:  jwt.MapClaims{"iss": "https://attacker.example.com", "aud": clientID, "sub": "u1"},
+			wantErr: "invalid id_token issuer",
+		},
+		{
+			name:    "missing issuer rejected",
+			claims:  jwt.MapClaims{"aud": clientID, "sub": "u1"},
+			wantErr: "invalid id_token issuer",
+		},
+		{
+			name:    "wrong audience rejected",
+			claims:  jwt.MapClaims{"iss": "https://appleid.apple.com", "aud": "other.example.com", "sub": "u1"},
+			wantErr: "invalid id_token audience",
+		},
+		{
+			name:    "missing audience rejected",
+			claims:  jwt.MapClaims{"iss": "https://appleid.apple.com", "sub": "u1"},
+			wantErr: "invalid id_token audience",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateAppleIDClaims(tt.claims, clientID)
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErr)
+		})
+	}
+}
+
 func TestAppleParseUserData(t *testing.T) {
 
 	ah := AppleHandler{Params: Params{L: logger.NoOp}}
@@ -307,6 +352,32 @@ func TestAppleHandler_LoginHandler(t *testing.T) {
 
 }
 
+// TestAppleHandler_LoginHandler_RejectsWrongIssuer is the regression-style
+// integration test: drives the full LoginHandler exchange flow with a token
+// signed by the test JWK but carrying iss other than https://appleid.apple.com.
+// With the validateAppleIDClaims call in place the handler returns 403; if
+// the call site is reverted the foreign-iss token authenticates and the
+// handler returns 200 with a JWT cookie -- this test then fails on the
+// status-code assertion. Same kind of property check but at the handler
+// boundary (the unit-level helper test alone won't catch a missing call).
+func TestAppleHandler_LoginHandler_RejectsWrongIssuer(t *testing.T) {
+	override := testIDTokenOverride{iss: "https://attacker.example.com"}
+	teardown := prepareAppleOauthTest(t, 8983, 8984, nil, override)
+	defer teardown()
+
+	jar, err := cookiejar.New(nil)
+	require.NoError(t, err)
+	client := &http.Client{Jar: jar, Timeout: 5 * time.Second}
+
+	resp, err := client.Get("http://localhost:8983/login?site=remark")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode, "wrong issuer must be rejected at the handler boundary")
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Contains(t, string(body), "invalid id_token")
+}
+
 func TestAppleHandler_LogoutHandler(t *testing.T) {
 
 	teardown := prepareAppleOauthTest(t, 8691, 8692, nil)
@@ -437,7 +508,11 @@ func prepareAppleHandlerTest(responseMode string, scopes []string) (*AppleHandle
 	return NewApple(p, aCfg, cl)
 }
 
-func prepareAppleOauthTest(t *testing.T, loginPort, authPort int, testToken *string) func() {
+func prepareAppleOauthTest(t *testing.T, loginPort, authPort int, testToken *string, overrides ...testIDTokenOverride) func() {
+	var override testIDTokenOverride
+	if len(overrides) > 0 {
+		override = overrides[0]
+	}
 	signKey, testJWK := createTestSignKeyPairs(t)
 	provider, err := prepareAppleHandlerTest("", []string{})
 	assert.NoError(t, err)
@@ -460,7 +535,7 @@ func prepareAppleOauthTest(t *testing.T, loginPort, authPort int, testToken *str
 	require.NoError(t, err)
 
 	// create self-signed JWT
-	testResponseToken, err := createTestResponseToken(signKey)
+	testResponseToken, err := createTestResponseTokenWith(signKey, override.issOrDefault(), override.audOrDefault())
 	require.NoError(t, err)
 	require.NotEmpty(t, testResponseToken)
 	if testToken != nil {
@@ -593,12 +668,35 @@ func prepareAppleOauthTest(t *testing.T, loginPort, authPort int, testToken *str
 	}
 }
 
-func createTestResponseToken(privKey interface{}) (string, error) {
+// testIDTokenOverride lets a test inject a token with non-default iss/aud
+// through prepareAppleOauthTest. The default (zero value) produces a token
+// with the canonical Apple issuer and the test ClientID, exercising the
+// happy path through validateAppleIDClaims.
+type testIDTokenOverride struct {
+	iss string
+	aud string
+}
+
+func (o testIDTokenOverride) issOrDefault() string {
+	if o.iss == "" {
+		return appleIDTokenIssuer
+	}
+	return o.iss
+}
+
+func (o testIDTokenOverride) audOrDefault() string {
+	if o.aud == "" {
+		return "auth.example.com"
+	}
+	return o.aud
+}
+
+func createTestResponseTokenWith(privKey interface{}, iss, aud string) (string, error) {
 	claims := &jwt.MapClaims{
-		"iss":   "http://go.localhost.test",
+		"iss":   iss,
 		"iat":   time.Now().Unix(),
 		"exp":   time.Now().Add(time.Second * 30).Unix(),
-		"aud":   "go-pkgz/auth",
+		"aud":   aud,
 		"sub":   "userid1",
 		"email": "test@example.go",
 	}

v2/provider/apple.go

@@ -13,6 +13,7 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -354,6 +355,12 @@ func (ah AppleHandler) AuthHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err = validateAppleIDClaims(tokenClaims, ah.conf.ClientID); err != nil {
+		ah.Logf("[WARN] apple id_token rejected: %s", err.Error())
+		rest.SendErrorJSON(w, r, ah.L, http.StatusForbidden, nil, "invalid id_token")
+		return
+	}
+
 	u := ah.mapUser(tokenClaims)
 
 	u, err = setAvatar(ah.AvatarSaver, u, &http.Client{Timeout: 5 * time.Second})
@@ -549,3 +556,28 @@ func (ah AppleHandler) makeRedirURL(path string) string {
 
 	return strings.TrimRight(ah.URL, "/") + strings.TrimSuffix(newPath, "/") + urlCallbackSuffix
 }
+
+// appleIDTokenIssuer is the issuer Apple sets on every id_token issued by Sign in with Apple.
+// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user
+const appleIDTokenIssuer = "https://appleid.apple.com" // #nosec G101 -- public Apple issuer URL, not a credential
+
+// validateAppleIDClaims checks that the id_token claims have the expected Apple
+// issuer and that the audience matches the relying party's client ID. The signature
+// must already have been verified by the caller; this only catches confused-deputy
+// cases where another Apple-signed token is replayed against the wrong audience.
+func validateAppleIDClaims(claims jwt.MapClaims, expectedAud string) error {
+	iss, err := claims.GetIssuer()
+	if err != nil || iss != appleIDTokenIssuer {
+		return errors.New("invalid id_token issuer")
+	}
+	aud, err := claims.GetAudience()
+	if err != nil {
+		return errors.New("invalid id_token audience")
+	}
+	for _, a := range aud {
+		if a == expectedAud {
+			return nil
+		}
+	}
+	return errors.New("invalid id_token audience")
+}