hanzoai/node-jsonwebtoken
2
0
Fork 0
mirror of https://github.com/hanzoai/node-jsonwebtoken.git synced 2026-09-24 17:00:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
456 Commits 1 Branch 75 Tags
master
Commit Graph
92 Commits
Author SHA1 Message Date
Jake LaceyandGitHub 0c20772774 fix(stubs): allow decode method to be stubbed (#876) 
* refactor: revert dcd6a34 to to solve #875, #870, and possibly also #876
 2023-04-03 09:27:06 +01:00
Filip SkokanandMarcos Castany dcd6a34519 refactor: make decode non-enumerable 
see #741
 2020-09-10 08:33:02 -03:00
José F. Romaniello e11d505207 refactor into multiple files 2016-07-12 09:49:04 -03:00
José F. Romaniello 65ddea934f Merge branch 'origin/clock_skew_tolerance' of https://github.com/jacopofar/node-jsonwebtoken into jacopofar-origin/clock_skew_tolerance 2016-04-29 11:30:21 -03:00
José F. Romaniello 7b0ba50bb9 Merge branch 'verify-unsigned-tokens' of https://github.com/jonekdahl/node-jsonwebtoken into jonekdahl-verify-unsigned-tokens 2016-04-27 13:22:07 -03:00
José F. Romaniello 53c3987b3c Improved the sign method 
Notable changes:

1.  `expiresInMinutes` and `expiresInSeconds` are deprecated and no longer supported.
2.  `notBeforeInMinutes` and `notBeforeInSeconds` are deprecated and no longer supported.
3.  options are properly validated.
4.  `options.expiresIn`, `options.notBefore`, `options.audience`, `options.issuer`, `options.subject` and `options.jwtid` are mutually exclusive with `payload.exp`, `payload.nbf`, `payload.aud`, `payload.iss`, `payload.sub` and `payload.jti` respectively.
5.  `options.algorithm` is properly validated.
6.  `options.headers` is renamed to `options.header`.
 2016-04-27 12:40:28 -03:00
José F. Romaniello e32043b8e9 make payload.exp and options.expiresIn exclusive 2016-04-27 11:43:22 -03:00
popomore 50873c7d45 feat: change .sign to standard async callback 
- subscribe error event
- change the first argument of the callback as error
 2016-04-27 17:24:51 +08:00
Jon Ekdahl 0f193887d3 Fix verification of unsigned tokens (fix #185) 2016-04-12 21:38:43 +02:00
Jacopo 58c865d832 maxAge is in milliseconds, not seconds 2016-03-25 00:38:17 +01:00
Jacopo 26e91cb17f clockTolerance for maxAge too 2016-03-25 00:35:58 +01:00
Jacopo 51d844d287 use clockTolerance when verifying 2016-03-25 00:20:39 +01:00
Jacopo e719a2c0a0 check that iat is undefined or a number 2016-03-25 00:02:56 +01:00
José F. Romaniello 39d9309ae0 add support for validating multiples issuers. closes #163 2016-02-16 09:23:39 -03:00
José F. Romaniello 7f7d76edfd fix wrong error when setting expiration on non-object payload. closes #153 2016-02-16 08:59:06 -03:00
José F. Romaniello a1affe960d added missing validations of sub and jti 2016-02-16 08:48:43 -03:00
José F. Romaniello 46552e7c45 minor 2016-01-04 12:43:10 -03:00
José F. Romaniello 71200f14de add a console.warn on invalid options for string payloads 2016-01-04 09:30:01 -03:00
José F. Romaniello be9c09af83 fix signing method with sealed objects, do not modify the params object. closes #147 2016-01-04 09:05:57 -03:00
José F. Romaniello 786d37b299 fix nbf verification. fix #152 2016-01-04 08:53:25 -03:00
José F. Romaniello 46372e928f improvements to nbf and jti claims 2015-12-28 14:09:17 -03:00
José F. Romaniello a3c5c23f5e Merge branch 'master' of https://github.com/TATDK/node-jsonwebtoken into TATDK-master 
Conflicts:
	README.md
	index.js
 2015-12-28 13:25:39 -03:00
yavorski 7c00bcbcbf Remove duplicate require('ms') line 2015-10-31 02:16:58 +02:00
Levi Botelho 8163d698e0 Remove duplicate payload line (fix bug in IE strict mode) 2015-10-07 09:07:55 -05:00
José F. Romaniello 39ecc6f8f3 deprecate expireInMinutes and expireInSeconds - in favor of expiresIn 2015-10-02 08:13:13 -03:00
José F. Romaniello 8e89ee4f57 Merge branch 'max-age' of https://github.com/jden/node-jsonwebtoken into jden-max-age 2015-10-02 08:07:55 -03:00
Luke William Westby 9414fbcb15 added async signing 2015-09-27 12:48:44 -05:00
José F. Romaniello 7787dd74e7 add tests for options.headers 2015-08-19 10:26:49 -03:00
simov 5feaa5b962 Fix typo options.header is not a documented option + 
Fix - do not modify the options.headers object
 2015-08-08 15:48:40 +03:00
jden 8078b11b22 fix spelling error in error message 2015-07-16 08:21:14 -07:00
jden 49d54e54f7 add verify option maxAge (with tests) 2015-07-15 21:48:52 -07:00
José F. Romaniello cfe05e961c Merge branch 'empty_secretOrPublicKey' of https://github.com/JackuB/node-jsonwebtoken into JackuB-empty_secretOrPublicKey 2015-07-15 09:00:25 -03:00
José F. Romaniello 61ff117227 minor 2015-07-15 08:57:50 -03:00
Chance Dickson 93f554312e Fix this referring to the global object instead of module.exports in verify() 2015-07-09 08:03:15 -04:00
TAT f26ba4e2fa Added nbf support 2015-06-26 22:46:14 +02:00
TAT ab76ec5bc5 Added support for subject and jwt id 2015-06-26 20:43:04 +02:00
José F. Romaniello 170dc0787d Merge pull request #88 from dbrugne/master 
Avoid uncaught "SyntaxError: Unexpected token ͧ" error.
 2015-06-15 07:26:01 -05:00
Jared Hanson 851bda2b10 Immediate return if not decoded. 2015-05-15 11:48:10 -07:00
Jared Hanson 7254e011b5 Add option to return header and payload when decoding. 2015-05-15 09:37:58 -07:00
dbrugne 0dc59cd6ee Avoid uncaught "SyntaxError: Unexpected token ͧ" error. 
When .verify() a corrupted JWS (e.g.: malicious user add extra characters in the middle of token) an error is thrown:

``
[ERROR] console - SyntaxError: Unexpected token ͧ
    at Object.parse (native)
    at Object.jwsDecode [as decode] (/www/socketio-jwt/node_modules/jsonwebtoken/node_modules/jws/lib/verify-stream.js:71:20)
    at Object.module.exports.verify (/www/socketio-jwt/node_modules/jsonwebtoken/index.js:120:26)`
 ``
 2015-05-07 11:32:59 +02:00
Jakub Mikulas f1cffd033b Simplified checking for missing key 2015-04-22 16:20:44 +02:00
Jakub Mikulas ffe68dbe02 Typo 2015-04-21 13:06:24 +02:00
Alberto Pose e900282a8d Merge pull request #75 from auth0/dschenkelman-patch-1 
Only set iat if there is none
 2015-04-10 17:39:25 -03:00
Alberto Pose 9f24ffd579 Renaming header.alg mismatch exception to invalid algorithm and adding more mismatch tests. 2015-04-10 14:53:42 -03:00
Alberto Pose 19e6cc6a1f Adding @dschenkelman feedback. 2015-04-10 13:54:03 -03:00
Alberto Pose 1e46234201 Updating to jws@^3.0.0 
As `[email protected]` changed the verify method signature to be `jws.verify(signature, algorithm, secretOrKey)`, the token header must be decoded first in order to make sure that the `alg` field matches one of the allowed `options.algorithms`. After that, the now validated `header.alg` is passed to `jws.verify`

As the order of steps has changed, the error that was thrown when the JWT was invalid is no longer the `jws` one:

{ [Error: Invalid token: no header in signature 'a.b.c'] code: 'MISSING_HEADER', signature: 'a.b.c' }

That old error (removed from jws) has been replaced by a `JsonWebTokenError` with message `invalid token`. That's why this change will bump be a major.
 2015-04-10 12:38:41 -03:00
Damian Schenkelman 35036b188b Only set iat if there is none 
Makes sense?
 2015-04-07 13:43:07 -03:00
Jakub Mikulas 0fdf78d4db Prevent throw on undefined/null secret 2015-03-30 19:29:25 +02:00
Alex Layton 8df6aabbc7 Fix verify for RSAPublicKey formated keys 2015-03-26 13:52:13 -04:00
José F. Romaniello 7017e74db9 fix issue when public key start with BEING PUBLIC KEY. closes #70 2015-03-17 13:16:12 -03:00