[m0tzy]

Summary

SessionCookie.authenticate() and Session.authenticateWithSessionCookie() now accept only user access tokens. Other tokens signed by the same environment key (agent and widget tokens) return INVALID_JWT. This matches workos-kotlin and the other WorkOS SDKs.

JwksVerifier.isValid checks the token after signature/exp verification and before the optional issuers check:

claims.getClaim("sid") is String &&
  claims.getClaim("auth_time") is Number &&
  (subProfile == null || subProfile == "user") &&
  claims.getClaim("sub_type") == null

User access tokens always include sid and auth_time, and they omit sub_profile or set it to "user". The signedJwt test helper now sets both by default. The new rejection test fails without the change.

Link to Devin session: https://app.devin.ai/sessions/7e123fc2545a49c282b043a4abd58f70
Open in Devin Desktop: https://app.devin.ai/desktop/session/7e123fc2545a49c282b043a4abd58f70?variant=devin
Requested by: @m0tzy

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from madison.packer

What's the fix here? https://linear.app/workos/issue/VULN-4839/lt-app26-10-user-vs-agent-jwt-type-confusion

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review

🟢 Devin Review found nothing to fix · View findings

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge.

Summary

Session-cookie authentication now rejects non-user tokens after signature and time checks, before the optional issuer check.

• Session cookies accept only user access tokens.

_{Reviews (1) · Last reviewed commit: "fix(session): Reject non-user access tok..." · Reviewed by Greptile}

[gjtorikian]

thank you!