hanzoai/node-jsonwebtoken
2
0
Fork 0
mirror of https://github.com/hanzoai/node-jsonwebtoken.git synced 2026-09-24 17:00:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
112 Commits 1 Branch 75 Tags
v4.2.2
Commit Graph
112 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
José F. Romaniello e46ca66344 4.2.2 v4.2.2 2015-03-26 16:44:53 -03:00
José F. Romaniello 402794663b Merge pull request #71 from awlayton/fix-begin-public-rsa 
Fix verify for RSAPublicKey formated keys
 2015-03-26 16:43:53 -03:00
Alex Layton 8df6aabbc7 Fix verify for RSAPublicKey formated keys 2015-03-26 13:52:13 -04:00
José F. Romaniello 4d22d08da2 4.2.1 v4.2.1 2015-03-17 13:17:03 -03:00
José F. Romaniello 7017e74db9 fix issue when public key start with BEING PUBLIC KEY. closes #70 2015-03-17 13:16:12 -03:00
José F. Romaniello 7863a84b1d 4.2.0 v4.2.0 2015-03-16 20:38:43 -03:00
José F. Romaniello c2bf7b2cd7 Merge pull request #69 from auth0/fix_alg_vuln_on_verify 
Verification with an asymmetric key of a token signed with a symmetric key
 2015-03-16 20:38:21 -03:00
José F. Romaniello 1bb584bc38 Verification with an asymmetric key of a token signed with a symmetric key 
There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).

This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.
 2015-03-16 20:36:22 -03:00
José F. Romaniello f9f3c34f84 fix commit links in changelog 2015-03-16 08:46:35 -03:00
José F. Romaniello 316fa4a4b8 add changelog. closes #67 2015-03-16 08:39:26 -03:00
José F. Romaniello b69d441c6e 4.1.0 v4.1.0 2015-03-10 14:00:09 -03:00
José F. Romaniello 2217e0b87d Merge branch 'abalmos-json-claim-set' 2015-03-10 13:59:52 -03:00
José F. Romaniello 3b0d0b6160 add one more test 2015-03-10 13:59:38 -03:00
Andrew Balmos 5290db1bd7 First assume JWT claim set is an object 
draft-ietf-oauth-json-web-token does not require JWT objects to have typ: "JWT"
in their header. Yet it expects that the JWT's claim set be JSON for validation.
See step 10 of draft-ietf-oauth-json-web-token section 7.2 "Validating a JWT".

Prior to this commit JWTs without typ: "JWT" in header are validated without
ever checking the claim set.
 2015-03-06 16:33:05 -05:00
José F. Romaniello db1cb1c864 4.0.0 v4.0.0 2015-03-06 12:10:44 -03:00
José F. Romaniello dd156cc30f add expiresInSeconds option to sign. closes #51 2015-03-06 12:08:38 -03:00
José F. Romaniello c7b3ab1946 remove broken test from bad merge 2015-03-06 12:01:49 -03:00
José F. Romaniello eae7f6900d Merge branch 'ben-bradley-ignoreExpiration' 2015-03-06 12:00:44 -03:00
José F. Romaniello 8d4da279e1 Merge branch 'ignoreExpiration' of https://github.com/ben-bradley/node-jsonwebtoken into ben-bradley-ignoreExpiration 
Conflicts:
	README.md
	index.js
	test/jwt.hs.tests.js
 2015-03-06 11:58:12 -03:00
José F. Romaniello 6448ce3267 add test for noTimestamp 2015-03-06 11:53:05 -03:00
Santiago AguiarandJosé F. Romaniello 331b7bc9cc Fixed exp value when noTimestamp is required. 2015-03-06 11:53:05 -03:00
José F. Romaniello 91417dd33f Merge pull request #57 from drichard/patch-1 
Update README to document the headers option.
 2015-03-06 11:39:20 -03:00
José F. Romaniello 1bfedf52bc Merge pull request #62 from auth0/update_jws_utf8 
this is a major change, it changes the default encoding from binary to utf8
 2015-03-06 11:37:17 -03:00
José F. Romaniello 62cbdb6666 add jshintrc 2015-03-06 09:29:00 -03:00
José F. Romaniello 1fc385ee10 allow passing encoding 2015-03-06 09:14:55 -03:00
José F. Romaniello 92d33bd99a this is a major change, it changes the default encoding from binary to utf8 2015-03-06 09:09:46 -03:00
david ff19d44005 Update README to document the headers option. 
Document the headers option in the jwt.sign method.
 2015-02-27 11:36:26 +11:00
Damian Schenkelman 82dd2495bf Merge pull request #55 from abalmos/expected-value 
Changes invalid aud and invalid iss errors to use actual expected value (from options object)
 2015-02-14 00:35:50 -03:00
Andrew Balmos 44e3c8d757 Changes aud/iss error to use actual expected value 
The message part of the JsonWebTokenError generated for aud and iss mismatch
currently use the [PAYLOAD AUDIENCE] and [PAYLOAD ISSUER] as the expected value.
This leads to confusion.  For example, say a JWT aud is set to
'https://localhost' and the expected value is 'https://localhost:8443'. The
resulting error message is:

'jwt audience invalid. expected: https://localhost:8443'

Which of courses tells the user that the audience is incorrect, yet the expected
value is the value sent.

This commit changes the error message to use the actual expected values,
[OPTIONS AUDIENCE] and [OPTIONS ISSUER].
 2015-02-13 21:08:55 -05:00
Nathan Totten 16f17df5ee Update README.md 2015-01-27 14:20:05 -08:00
Nathan Totten c20ce78e08 Update and rename LICENSE.md to LICENSE 2015-01-27 14:18:58 -08:00
Alberto Pose 8d7b90e799 3.2.2 v3.2.2 2015-01-15 12:00:25 -03:00
Alberto Pose 89ec214008 Updating jws to 1.0.1 2015-01-15 12:00:09 -03:00
José F. Romaniello 41cc7b7d87 3.2.1 v3.2.1 2015-01-08 08:55:40 -03:00
José F. Romaniello fb3183e83b fix engines section 2015-01-08 08:55:35 -03:00
José F. Romaniello 5e1c03fb90 3.2.0 v3.2.0 2014-12-29 16:11:14 -03:00
José F. Romaniello b3f3a95508 allow forcing json parsing when decoding even if the header doesn't contain typ:JWT 2014-12-29 16:11:05 -03:00
José F. Romaniello 32702c25bd 3.1.1 v3.1.1 2014-12-29 14:20:44 -03:00
José F. Romaniello 40f1cce24c fail verification when exp is not a number. closes #28 2014-12-29 14:20:32 -03:00
José F. Romaniello 3854502087 3.1.0 v3.1.0 2014-12-29 13:29:29 -03:00
José F. Romaniello bea8a31fd0 fix error when payload is not an object. Closes #14 2014-12-29 13:29:24 -03:00
José F. Romaniello 1076414a09 3.0.0 v3.0.0 2014-12-29 13:06:24 -03:00
José F. Romaniello d958fcac04 Merge branch 'fix_encoding_issue' 2014-12-29 13:06:13 -03:00
José F. Romaniello b6483581c4 fix encoding issue. closes #40 2014-12-29 13:01:12 -03:00
Ben Bradley 002cce17c0 Added option to ignore expirations in tokens 2014-12-22 12:02:04 -08:00
José F. Romaniello 0aad51615b 2.0.0 v2.0.0 2014-12-20 00:03:38 -03:00
José F. Romaniello 38d168e572 Merge pull request #25 from awlayton/master 
Allow passing JOSE headers to sign function
 2014-12-20 00:02:08 -03:00
José F. Romaniello 0a9888fd8f Merge branch 'Asana-option-no-timestamp' 2014-12-19 23:50:02 -03:00
José F. Romaniello 81e45ae3b5 Merge branch 'option-no-timestamp' of https://github.com/Asana/node-jsonwebtoken into Asana-option-no-timestamp 
Conflicts:
	index.js
 2014-12-19 23:49:06 -03:00
José F. Romaniello 7c13631184 Merge branch 'tapayne88-enforce-async-sync' 2014-12-19 23:45:56 -03:00