José F. Romaniello
7863a84b1d
4.2.0
2015-03-16 20:38:43 -03:00
José F. Romaniello
c2bf7b2cd7
Merge pull request #69 from auth0/fix_alg_vuln_on_verify
...
Verification with an asymmetric key of a token signed with a symmetric key
2015-03-16 20:38:21 -03:00
José F. Romaniello
1bb584bc38
Verification with an asymmetric key of a token signed with a symmetric key
...
There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).
This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.
2015-03-16 20:36:22 -03:00
José F. Romaniello
f9f3c34f84
fix commit links in changelog
2015-03-16 08:46:35 -03:00
José F. Romaniello
316fa4a4b8
add changelog. closes #67
2015-03-16 08:39:26 -03:00
José F. Romaniello
b69d441c6e
4.1.0
2015-03-10 14:00:09 -03:00
José F. Romaniello
2217e0b87d
Merge branch 'abalmos-json-claim-set'
2015-03-10 13:59:52 -03:00
José F. Romaniello
3b0d0b6160
add one more test
2015-03-10 13:59:38 -03:00
Andrew Balmos
5290db1bd7
First assume JWT claim set is an object
...
draft-ietf-oauth-json-web-token does not require JWT objects to have typ: "JWT"
in their header. Yet it expects that the JWT's claim set be JSON for validation.
See step 10 of draft-ietf-oauth-json-web-token section 7.2 "Validating a JWT".
Prior to this commit JWTs without typ: "JWT" in header are validated without
ever checking the claim set.
2015-03-06 16:33:05 -05:00
José F. Romaniello
db1cb1c864
4.0.0
2015-03-06 12:10:44 -03:00
José F. Romaniello
dd156cc30f
add expiresInSeconds option to sign. closes #51
2015-03-06 12:08:38 -03:00
José F. Romaniello
c7b3ab1946
remove broken test from bad merge
2015-03-06 12:01:49 -03:00
José F. Romaniello
eae7f6900d
Merge branch 'ben-bradley-ignoreExpiration'
2015-03-06 12:00:44 -03:00
José F. Romaniello
8d4da279e1
Merge branch 'ignoreExpiration' of https://github.com/ben-bradley/node-jsonwebtoken into ben-bradley-ignoreExpiration
...
Conflicts:
README.md
index.js
test/jwt.hs.tests.js
2015-03-06 11:58:12 -03:00
José F. Romaniello
6448ce3267
add test for noTimestamp
2015-03-06 11:53:05 -03:00
Santiago Aguiar and José F. Romaniello
331b7bc9cc
Fixed exp value when noTimestamp is required.
2015-03-06 11:53:05 -03:00
José F. Romaniello
91417dd33f
Merge pull request #57 from drichard/patch-1
...
Update README to document the headers option.
2015-03-06 11:39:20 -03:00
José F. Romaniello
1bfedf52bc
Merge pull request #62 from auth0/update_jws_utf8
...
this is a major change, it changes the default encoding from binary to utf8
2015-03-06 11:37:17 -03:00
José F. Romaniello
62cbdb6666
add jshintrc
2015-03-06 09:29:00 -03:00
José F. Romaniello
1fc385ee10
allow passing encoding
2015-03-06 09:14:55 -03:00
José F. Romaniello
92d33bd99a
this is a major change, it changes the default encoding from binary to utf8
2015-03-06 09:09:46 -03:00
david
ff19d44005
Update README to document the headers option.
...
Document the headers option in the jwt.sign method.
2015-02-27 11:36:26 +11:00
Damian Schenkelman
82dd2495bf
Merge pull request #55 from abalmos/expected-value
...
Changes invalid aud and invalid iss errors to use actual expected value (from options object)
2015-02-14 00:35:50 -03:00
Andrew Balmos
44e3c8d757
Changes aud/iss error to use actual expected value
...
The message part of the JsonWebTokenError generated for aud and iss mismatch
currently use the [PAYLOAD AUDIENCE] and [PAYLOAD ISSUER] as the expected value.
This leads to confusion. For example, say a JWT aud is set to
'https://localhost ' and the expected value is 'https://localhost:8443 '. The
resulting error message is:
'jwt audience invalid. expected: https://localhost:8443 '
Which of courses tells the user that the audience is incorrect, yet the expected
value is the value sent.
This commit changes the error message to use the actual expected values,
[OPTIONS AUDIENCE] and [OPTIONS ISSUER].
2015-02-13 21:08:55 -05:00
Nathan Totten
16f17df5ee
Update README.md
2015-01-27 14:20:05 -08:00
Nathan Totten
c20ce78e08
Update and rename LICENSE.md to LICENSE
2015-01-27 14:18:58 -08:00
Alberto Pose
8d7b90e799
3.2.2
2015-01-15 12:00:25 -03:00
Alberto Pose
89ec214008
Updating jws to 1.0.1
2015-01-15 12:00:09 -03:00
José F. Romaniello
41cc7b7d87
3.2.1
2015-01-08 08:55:40 -03:00
José F. Romaniello
fb3183e83b
fix engines section
2015-01-08 08:55:35 -03:00
José F. Romaniello
5e1c03fb90
3.2.0
2014-12-29 16:11:14 -03:00
José F. Romaniello
b3f3a95508
allow forcing json parsing when decoding even if the header doesn't contain typ:JWT
2014-12-29 16:11:05 -03:00
José F. Romaniello
32702c25bd
3.1.1
2014-12-29 14:20:44 -03:00
José F. Romaniello
40f1cce24c
fail verification when exp is not a number. closes #28
2014-12-29 14:20:32 -03:00
José F. Romaniello
3854502087
3.1.0
2014-12-29 13:29:29 -03:00
José F. Romaniello
bea8a31fd0
fix error when payload is not an object. Closes #14
2014-12-29 13:29:24 -03:00
José F. Romaniello
1076414a09
3.0.0
2014-12-29 13:06:24 -03:00
José F. Romaniello
d958fcac04
Merge branch 'fix_encoding_issue'
2014-12-29 13:06:13 -03:00
José F. Romaniello
b6483581c4
fix encoding issue. closes #40
2014-12-29 13:01:12 -03:00
Ben Bradley
002cce17c0
Added option to ignore expirations in tokens
2014-12-22 12:02:04 -08:00
José F. Romaniello
0aad51615b
2.0.0
2014-12-20 00:03:38 -03:00
José F. Romaniello
38d168e572
Merge pull request #25 from awlayton/master
...
Allow passing JOSE headers to sign function
2014-12-20 00:02:08 -03:00
José F. Romaniello
0a9888fd8f
Merge branch 'Asana-option-no-timestamp'
2014-12-19 23:50:02 -03:00
José F. Romaniello
81e45ae3b5
Merge branch 'option-no-timestamp' of https://github.com/Asana/node-jsonwebtoken into Asana-option-no-timestamp
...
Conflicts:
index.js
2014-12-19 23:49:06 -03:00
José F. Romaniello
7c13631184
Merge branch 'tapayne88-enforce-async-sync'
2014-12-19 23:45:56 -03:00
José F. Romaniello
4ff7b6c0a8
Merge branch 'enforce-async-sync' of https://github.com/tapayne88/node-jsonwebtoken into tapayne88-enforce-async-sync
...
Conflicts:
index.js
2014-12-19 23:45:25 -03:00
José F. Romaniello
d655dda79d
Merge branch 'mprinc-master'
2014-12-19 23:42:08 -03:00
José F. Romaniello
d380a1710e
Merge branch 'master' of https://github.com/mprinc/node-jsonwebtoken into mprinc-master
2014-12-19 23:41:49 -03:00
Thomas Payne
0acfe4f503
Made verify truly asynchronous or synchronous, Zalgo has been contained!
2014-12-12 16:45:19 +00:00
siacomuzzi
eea72087db
1.3.0
2014-12-10 20:06:15 -03:00
José F. Romaniello