Check for the typ property in preVerifiedTokens

[ckarlof]

Such a thing was suggested by @rfk, and I added to the docs:

https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#preverifytoken

[dannycoates]

I'm skeptical

[ckarlof]

Not much value now, but it will be important if an issuer generates two different tokens with the same key. In that case it will mitigate certain attacks, e.g., a low value token being used in place of a high value token, because the typ field can disambiguate the purpose of the token.

[ckarlof]

Adding to our token generation lib: https://github.com/shane-tomlinson/fxa-crypto-utils/pull/2

[baldawarishi]

How will typ property be verified?

I'm thinking it'll happened somewhere around or near this file.

fxa-auth-server/lib/preverifier.js

Line 29 in bbe0688

function isValidToken(email, token) {

[ckarlof]

@rishibaldawa, I think that's right, but you'll probably need to pass in the expected typ and figure out how that works with the rest of the code.