* fix!: Disable use of weak RSA key sizes for asymmetric algorithms
Added checks to prevent invalid secrets from being used with the HS*** algorithms when signing and verifying
Added checks to prevent the use of insecure asymmetric key sizes except when explicitly overriden via options
Prevented Buffers containing malicious objects from being used as key material.
BREAKING CHANGE: Requires node 12.x or later to allow use of `KeyObject`
* fix(sign&verify)!: Remove default none support from sign and verify methods, and require it to be explicitly configured
BREAKING CHANGE: Removes fallback for none algorithm for the verify method.
* Add extension to ESLint config file
The .eslintrc file without an extension was deprecated a few years ago,
so this change renames the file to add the required extension.
See: https://github.com/eslint/eslint/commit/c9a8883d450d63a8d044a9e66d275f5b1973a3ba
* Add ESLint to package.json
This change adds ESLint as a dev-dependency and adds a lint script that
will run ESLint.
* Complete switch from JSHint to ESLint
Convert all the JSHint rules to the ESLint equivalents where possible.
The no-undef rule in ESLint caught a few cases of undefined usages in
the tests, so they were also fixed.
* Add a .eslintignore file
The HTML coverage report is currently being linted, which causes a lot
if invalid linting errors. This change adds a ignore file to ensure these
files are properly skipped during linting.
* Corrected indistinguishable error messages
jws.decode() never throws an error. At least, in its current version. However, if it were to throw an exception, the diagnostics would be indistinguishable from a soft failure to decode a token. I had an extra trailing space on my JWT and it took me some additional debugging work to trace the actual root cause because the error message was not distinct.
* Allowed an exception from inside of jws.decode to be handled by the caller. Currently, jws.decode never throws an exception. The change is made per discsussion in the original PR
* Added a test case and proper forwarding of the possible exception thrown from jws.decode
* Typo correction
