toss-edge-hardening

Enforce JWT-based authorization in Edge Functions by patching each function to validate JWT claims for minimum permissions, removing trust in caller headers to prevent privilege escalation, then redeploying and validating via edge logs.

Trusting caller headers in Edge Functions creates security vulnerabilities because incomplete authorization checks allow callers to spoof headers and escalate privileges, whereas JWT claims provide cryptographically verifiable role enforcement.

Validate Edge Function security patches after redeployment by replaying runtime requests to confirm non-privileged responses and checking edge logs to verify that JWT-based authorization properties hold.

You can apply JWT hardening across multiple Edge Functions including verify_iap_order, generate_report, send-smart-message, and grant-toss-points by patching each function to enforce per-function minimum permissions via JWT claims.

The best way to audit Edge Functions for authorization bypass risks is to review verify_jwt-enabled functions for reliance on caller headers, then patch them to enforce JWT-based roles and validate behavior with regression testing.

You need edge logs to confirm Edge Function security hardening because they provide post-patch redeploy evidence and runtime verification trails that validate JWT-based authorization properties are enforced correctly.