Skip to content

Fix for jwt verification-error-format#5918

Closed
yallalingyaradetti92 wants to merge 1 commit into
supabase:developfrom
yallalingyaradetti92:fix-jwt-verification-error-format
Closed

Fix for jwt verification-error-format#5918
yallalingyaradetti92 wants to merge 1 commit into
supabase:developfrom
yallalingyaradetti92:fix-jwt-verification-error-format

Conversation

@yallalingyaradetti92

Copy link
Copy Markdown

Summary

Fixes inconsistent JWT verification error response formatting in the local edge-runtime (supabase start / functions serve). When JWT verification fails, the response used {"msg": "..."}, but production's Management API returns {"error": "..."}. This broke client code (and Studio's own edge-function test panel) that expects the error key, causing silent failures since the actual error detail was never surfaced.

This change:

  • Updates both JWT-failure response paths in apps/cli/src/shared/functions/serve.main.ts (the canonical edge-runtime bootstrap script) from { msg: ... } to { error: ... }.
  • Regenerates the Go-embedded copy (apps/cli-go/internal/functions/serve/templates/main.bundled.js) via the repo's own bundleServeMainTemplate() bundler, so supabase start's Go binary (which embeds this bundle via go:embed) stays in sync with the TS source, per the existing drift-detection test (serve-main-go-template.unit.test.ts).

Verified end-to-end against a live local stack, not just unit tests: ran functions serve with a real verify_jwt = true function and sent real HTTP requests —

  • Missing Authorization header → {"error":"Error: Missing authorization header"} (401)
  • Invalid JWT → {"error":"Invalid JWT"} (401)
  • Valid JWT (sanity check) → function executes normally (200), confirming the fix doesn't break the success path.

Linked issue

Closes #5861

  • The linked issue is open and carries the open-for-contribution label (or I'm a Supabase maintainer).

Checklist

  • The PR title follows Conventional Commits (e.g. fix(cli): …).
  • Tests added or updated for the change.
  • pnpm check:all and pnpm test pass for the workspace(s) I touched.

@yallalingyaradetti92
yallalingyaradetti92 requested a review from a team as a code owner July 21, 2026 13:20

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d885f5e8ce

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".


if (!isValidJWT) {
return getResponse({ msg: "Invalid JWT" }, STATUS_CODE.Unauthorized);
return getResponse({ error: "Invalid JWT" }, STATUS_CODE.Unauthorized);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the stack runtime JWT error shape too

This only changes the CLI serve bootstrap, but the programmatic local stack runtime has the same JWT gate in packages/stack/src/services/edge-runtime-main.ts and still returns { msg: ... } for missing, malformed, and invalid tokens (lines 68-87); that file is loaded as the edge-runtime main service by packages/stack/src/services/edge-runtime.ts. In contexts that run functions through the TS stack runtime rather than this functions serve/Go embedded bundle, clients and Studio will still miss the error field this fix is intended to provide, so the regression remains on that local stack path.

Useful? React with 👍 / 👎.

} catch (e) {
console.error(e);
return getResponse({ msg: e.toString() }, STATUS_CODE.Unauthorized);
return getResponse({ error: e.toString() }, STATUS_CODE.Unauthorized);

@7ttp 7ttp Jul 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks! @yallalingyaradetti92
but this is being worked on here: #5862 (different approach)

also re message -> error change u can check the cmt here: (#5862 (comment))

Thanks again! for ur efforts towards contributing to Supabase!! 💚🙂

@7ttp 7ttp closed this Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Edge function JWT verification errors return { msg } instead of { error } in serve.main.ts

2 participants