hanzoai/node-jsonwebtoken
2
0
Fork 0
mirror of https://github.com/hanzoai/node-jsonwebtoken.git synced 2026-09-24 17:00:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

added missing validations of sub and jti

Browse Source
This commit is contained in:
José F. Romaniello
2016-02-16 08:48:43 -03:00
parent 8aedf2b1f5
commit a1affe960d
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
index.js
+12
View File
@@ -258,6 +258,18 @@ JWT.verify = function(jwtString, secretOrPublicKey, options, callback) {
return done(new JsonWebTokenError('jwt issuer invalid. expected: ' + options.issuer));
}
if (options.subject) {
if (payload.sub !== options.subject) {
return done(new JsonWebTokenError('jwt subject invalid. expected: ' + options.subject));
}
}
if (options.jwtid) {
if (payload.jti !== options.jwtid) {
return done(new JsonWebTokenError('jwt jwtid invalid. expected: ' + options.jwtid));
}
}
if (options.maxAge) {
var maxAge = ms(options.maxAge);
if (typeof payload.iat !== 'number') {