From 363d6ac24bf26c7a0beab4ebc465d2a9a5e72bf0 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Date: Fri, 2 Oct 2026 23:05:09 -0400
Subject: [PATCH] fix(security): require JWT expiry and audit subject claims

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
---
 security/security-architect.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/security-architect.md b/security/security-architect.md
index 0dbc2272..b0c504f5 100644
--- a/security/security-architect.md
+++ b/security/security-architect.md
@@ -128,6 +128,7 @@ from pydantic import BaseModel, Field, field_validator
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 import re
+import jwt  # PyJWT; settings and audit_log come from the application's configuration
 
 app = FastAPI(docs_url=None, redoc_url=None)  # Disable docs in production
 security = HTTPBearer()
@@ -154,6 +155,7 @@ async def verify_token(credentials: HTTPAuthorizationCredentials = Depends(secur
             algorithms=["RS256"],
             audience=settings.JWT_AUDIENCE,
             issuer=settings.JWT_ISSUER,
+            options={"require": ["exp", "sub"]},  # missing expiry or actor is not a valid access token
         )
         return payload
     except jwt.InvalidTokenError: