[m0tzy]

Summary

verifyAccessToken in session.ts (used by updateSession/withAuth and assertValidAccessToken) only ran jwtVerify: signature, exp, and iss when WORKOS_ISSUER is set. It didn't check that the token was a user session access token, so other token types signed by the same environment key were accepted as a session.

const { payload } = await jwtVerify(accessToken, JWKS(), issuer ? { issuer } : undefined);
if (!isUserAccessTokenPayload(payload)) {
  return { status: 'invalid', cause: new Error('Access token is not a user access token') };
}
// typeof sid === 'string' && typeof auth_time === 'number'
// && (sub_profile === undefined || sub_profile === 'user') && sub_type === undefined

This matches hasRequiredAccessTokenClaims in @workos-inc/node. sub_profile is optional on user access tokens, so a missing claim is still accepted. A rejected token takes the existing invalid path: the cookie is deleted and no refresh is attempted, the same as a bad signature.

Tests: a new should reject a verified token with %s without attempting to refresh it covers sub_profile: ai_agent, sub_type: authkit, a missing or string auth_time, and a missing or numeric sid. All 6 cases fail without the session.ts change.

Fixture plumbing: most specs mocked jwtVerify to resolve undefined, true or {}. They now resolve the shared verifiedUserAccessToken from test-helpers.ts, and generateTestToken includes auth_time by default.

Link to Devin session: https://app.devin.ai/sessions/7e123fc2545a49c282b043a4abd58f70
Open in Devin Desktop: https://app.devin.ai/desktop/session/7e123fc2545a49c282b043a4abd58f70?variant=devin
Requested by: @m0tzy

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from madison.packer

What's the fix here? https://linear.app/workos/issue/VULN-4839/lt-app26-10-user-vs-agent-jwt-type-confusion

[devin-ai-integration]

Devin Review

🟢 Devin Review found nothing to fix · View findings · Follow Devin's work

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable defects were found.

Summary

This PR rejects non-user access tokens before trusting or saving a session.

• Session cookies now accept only tokens with user-session claims.

No actionable issues were found. Tests were not run.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Verify access token] --> B{User token claims?}
  B -->|Yes| C[Use or save session]
  B -->|No| D[Reject token]
  D --> E[Clear existing cookie or refuse session write]

Loading

_{Reviews (1) · Last reviewed commit: "fix(session): Reject non-user access tok..." · Reviewed by Greptile}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.