SIGN IN SIGN UP

Normalize App ID to String & Enhance JWT Issuer Verification (#3272)

This PR fixes PyGithub/PyGithub#3214 by ensuring self._app_id is always
a string in AppAuth, preventing type mismatches in the JWT "iss" claim.
It also strengthens JWT tests by adding issuer validation during
decoding.

The AppAuth class previously stored self._app_id as-is (either int or
str, per Union[int, str]), which could result in the JWT "iss" claim
being an integer. Per the JWT specification ([RFC 7519, Section
4.1.1](https://tools.ietf.org/html/rfc7519#section-4.1.1)), the iss
(issuer) claim should be a string, and GitHub’s authentication flow
expects it as such. This type mismatch caused potential failures in
downstream processing or validation (e.g., with PyJWT or GitHub’s API),
as reported in #3214. Additionally, the tests lacked proactive issuer
checks, relying only on payload comparison, which missed an opportunity
to catch errors earlier.

**Changes**

- String Normalization in AppAuth (github/Auth.py): `Changed
self._app_id = app_id to self._app_id = str(app_id)` in the initializer.
This ensures the "iss" claim is consistently a string, regardless of
whether the input app_id is an integer (common for GitHub App IDs) or a
string.
- Test Improvements (tests/Authentication.py): Updated testCreateJWT and
testCreateJWTWithExpiration to expect a string "iss" and added
`issuer=str(APP_ID)` to jwt.decode(). This leverages PyJWT’s built-in
issuer validation (introduced in PyJWT 1.0.0+), aligning with its
security features and failing fast on issuer mismatches.

**Fixes**
✅ Fixes type mismatch in JWT "iss" claim.
✅ Enhances test robustness by failing early on incorrect issuers.

**Impact**
Fixes the root cause of type-related errors in JWT generation, ensuring
compliance with RFC 7519 and GitHub’s expectations.
Strengthens tests by mirroring real-world validation (e.g., GitHub
rejecting tokens with invalid iss), reducing the risk of regressions.

**Testing**
Verified with pytest tests/Authentication.py—both testCreateJWT and
testCreateJWTWithExpiration pass with the updated expectations and
issuer verification.

Fixes:
[PyGithub/PyGithub#3214](https://github.com/PyGithub/PyGithub/issues/3214)

---------

Co-authored-by: Enrico Minack <github@enrico.minack.dev>
S
Soubhik Kumar Mitra committed
01196d67452e726a1ef6a26312e50e428b6a705d
Parent: c7858c8
Committed by GitHub <noreply@github.com> on 7/30/2025, 9:19:02 PM