fix: validate JWT exp claim in Go services using ParseWithClaims

services/attendance-service/auth.go

@@ -7,6 +7,13 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
+type internalClaims struct {
+	jwt.RegisteredClaims
+	UserID   string `json:"user_id"`
+	UserRole string `json:"user_role"`
+	TenantID string `json:"tenant_id"`
+}
+
 var internalJWTSecret []byte
 
 func initAuth() {
@@ -28,25 +35,25 @@ func authMiddleware(c *fiber.Ctx) error {
 		return c.Status(401).JSON(fiber.Map{"error": "Missing internal authentication"})
 	}
 
-	token, err := jwt.Parse(internalToken, func(token *jwt.Token) (interface{}, error) {
+	token, err := jwt.ParseWithClaims(internalToken, &internalClaims{}, func(token *jwt.Token) (interface{}, error) {
 		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 			return nil, fiber.NewError(401, "Invalid signing method")
 		}
 		return internalJWTSecret, nil
 	})
 
-	if err != nil || !token.Valid {
+	if err != nil {
 		return c.Status(401).JSON(fiber.Map{"error": "Invalid internal authentication"})
 	}
 
-	claims, ok := token.Claims.(jwt.MapClaims)
+	claims, ok := token.Claims.(*internalClaims)
 	if !ok {
 		return c.Status(401).JSON(fiber.Map{"error": "Invalid token claims"})
 	}
 
-	userID, _ := claims["user_id"].(string)
-	userRole, _ := claims["user_role"].(string)
-	tenantID, _ := claims["tenant_id"].(string)
+	userID := claims.UserID
+	userRole := claims.UserRole
+	tenantID := claims.TenantID
 
 	if tenantID == "" {
 		tenantID = "default"

services/leave-service/pom.xml

@@ -31,6 +31,10 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-amqp</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-aop</artifactId>

services/lms-service/middleware/auth.go

@@ -7,6 +7,13 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
+type internalClaims struct {
+	jwt.RegisteredClaims
+	UserID   string `json:"user_id"`
+	UserRole string `json:"user_role"`
+	TenantID string `json:"tenant_id"`
+}
+
 var internalJWTSecret []byte
 
 func InitAuth() {
@@ -29,25 +36,25 @@ func AuthMiddleware() fiber.Handler {
 			return c.Status(401).JSON(fiber.Map{"error": "Missing internal authentication"})
 		}
 
-		token, err := jwt.Parse(internalToken, func(token *jwt.Token) (interface{}, error) {
+		token, err := jwt.ParseWithClaims(internalToken, &internalClaims{}, func(token *jwt.Token) (interface{}, error) {
 			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 				return nil, fiber.NewError(401, "Invalid signing method")
 			}
 			return internalJWTSecret, nil
 		})
 
-		if err != nil || !token.Valid {
+		if err != nil {
 			return c.Status(401).JSON(fiber.Map{"error": "Invalid internal authentication"})
 		}
 
-		claims, ok := token.Claims.(jwt.MapClaims)
+		claims, ok := token.Claims.(*internalClaims)
 		if !ok {
 			return c.Status(401).JSON(fiber.Map{"error": "Invalid token claims"})
 		}
 
-		userID, _ := claims["user_id"].(string)
-		userRole, _ := claims["user_role"].(string)
-		tenantID, _ := claims["tenant_id"].(string)
+		userID := claims.UserID
+		userRole := claims.UserRole
+		tenantID := claims.TenantID
 
 		if tenantID == "" {
 			tenantID = "default"

services/notification-go-service/main.go

@@ -110,12 +110,22 @@ var (
 	mutex     = &sync.Mutex{}
 )
 
-func validateJWT(tokenString string) (jwt.MapClaims, error) {
+type wsClaims struct {
+	jwt.RegisteredClaims
+	TenantID string `json:"tenant_id"`
+}
+
+type internalAuthClaims struct {
+	jwt.RegisteredClaims
+	TenantID string `json:"tenant_id"`
+}
+
+func validateJWT(tokenString string) (*wsClaims, error) {
 	secret := os.Getenv("JWT_SECRET")
 	if secret == "" {
 		return nil, fmt.Errorf("JWT_SECRET not configured")
 	}
-	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &wsClaims{}, func(token *jwt.Token) (interface{}, error) {
 		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
 		}
@@ -124,10 +134,11 @@ func validateJWT(tokenString string) (jwt.MapClaims, error) {
 	if err != nil {
 		return nil, err
 	}
-	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
-		return claims, nil
+	claims, ok := token.Claims.(*wsClaims)
+	if !ok {
+		return nil, fmt.Errorf("invalid token claims")
 	}
-	return nil, fmt.Errorf("invalid token")
+	return claims, nil
 }
 
 func internalAuthMiddleware(next http.HandlerFunc) http.HandlerFunc {
@@ -144,27 +155,26 @@ func internalAuthMiddleware(next http.HandlerFunc) http.HandlerFunc {
 			return
 		}
 
-		token, err := jwt.Parse(internalToken, func(token *jwt.Token) (interface{}, error) {
+		token, err := jwt.ParseWithClaims(internalToken, &internalAuthClaims{}, func(token *jwt.Token) (interface{}, error) {
 			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 				return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
 			}
 			return []byte(internalKey), nil
 		})
 
-		if err != nil || !token.Valid {
+		if err != nil {
 			http.Error(w, `{"error":"Invalid internal authentication"}`, http.StatusUnauthorized)
 			return
 		}
 
-		claims, ok := token.Claims.(jwt.MapClaims)
+		claims, ok := token.Claims.(*internalAuthClaims)
 		if !ok {
 			http.Error(w, `{"error":"Invalid token claims"}`, http.StatusUnauthorized)
 			return
 		}
 
-		tenantID, _ := claims["tenant_id"].(string)
-		if tenantID != "" {
-			r.Header.Set("X-Tenant-Id", tenantID)
+		if claims.TenantID != "" {
+			r.Header.Set("X-Tenant-Id", claims.TenantID)
 		}
 
 		next(w, r)
@@ -236,7 +246,7 @@ func handleConnections(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	tenantID, _ := claims["tenant_id"].(string)
+	tenantID := claims.TenantID
 	if tenantID == "" {
 		tenantID = "default"
 	}

services/payroll-java-service/pom.xml

@@ -38,6 +38,10 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-validation</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-aop</artifactId>

services/performance-service/pom.xml

@@ -38,6 +38,10 @@
 			<artifactId>postgresql</artifactId>
 			<scope>runtime</scope>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.flywaydb</groupId>
 			<artifactId>flyway-core</artifactId>