Alex Layton
8df6aabbc7
Fix verify for RSAPublicKey formated keys
2015-03-26 13:52:13 -04:00
José F. Romaniello
7017e74db9
fix issue when public key start with BEING PUBLIC KEY. closes #70
2015-03-17 13:16:12 -03:00
José F. Romaniello
1bb584bc38
Verification with an asymmetric key of a token signed with a symmetric key
...
There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).
This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.
2015-03-16 20:36:22 -03:00
José F. Romaniello
3b0d0b6160
add one more test
2015-03-10 13:59:38 -03:00
Andrew Balmos
5290db1bd7
First assume JWT claim set is an object
...
draft-ietf-oauth-json-web-token does not require JWT objects to have typ: "JWT"
in their header. Yet it expects that the JWT's claim set be JSON for validation.
See step 10 of draft-ietf-oauth-json-web-token section 7.2 "Validating a JWT".
Prior to this commit JWTs without typ: "JWT" in header are validated without
ever checking the claim set.
2015-03-06 16:33:05 -05:00
José F. Romaniello
dd156cc30f
add expiresInSeconds option to sign. closes #51
2015-03-06 12:08:38 -03:00
José F. Romaniello
c7b3ab1946
remove broken test from bad merge
2015-03-06 12:01:49 -03:00
José F. Romaniello
8d4da279e1
Merge branch 'ignoreExpiration' of https://github.com/ben-bradley/node-jsonwebtoken into ben-bradley-ignoreExpiration
...
Conflicts:
README.md
index.js
test/jwt.hs.tests.js
2015-03-06 11:58:12 -03:00
José F. Romaniello
6448ce3267
add test for noTimestamp
2015-03-06 11:53:05 -03:00
José F. Romaniello
1fc385ee10
allow passing encoding
2015-03-06 09:14:55 -03:00
José F. Romaniello
92d33bd99a
this is a major change, it changes the default encoding from binary to utf8
2015-03-06 09:09:46 -03:00
José F. Romaniello
40f1cce24c
fail verification when exp is not a number. closes #28
2014-12-29 14:20:32 -03:00
José F. Romaniello
bea8a31fd0
fix error when payload is not an object. Closes #14
2014-12-29 13:29:24 -03:00
José F. Romaniello
b6483581c4
fix encoding issue. closes #40
2014-12-29 13:01:12 -03:00
Ben Bradley
002cce17c0
Added option to ignore expirations in tokens
2014-12-22 12:02:04 -08:00
José F. Romaniello
4ff7b6c0a8
Merge branch 'enforce-async-sync' of https://github.com/tapayne88/node-jsonwebtoken into tapayne88-enforce-async-sync
...
Conflicts:
index.js
2014-12-19 23:45:25 -03:00
José F. Romaniello
d380a1710e
Merge branch 'master' of https://github.com/mprinc/node-jsonwebtoken into mprinc-master
2014-12-19 23:41:49 -03:00
Thomas Payne
0acfe4f503
Made verify truly asynchronous or synchronous, Zalgo has been contained!
2014-12-12 16:45:19 +00:00
Joshua Perry
a135caacad
Add support for aud array and scalar strings Fixes #33
2014-11-25 18:42:42 -07:00
Sasha Mile Rudan
9427f35512
Fixed bug in verify function with missing options and existing callback function
2014-11-15 00:17:50 +01:00
José F. Romaniello
01ba8a8443
do not throw exception when the payload is not json. related to #14
2014-09-15 11:50:50 -03:00
Marwan Hilmi
f6e5e9d10d
Verifying null fix.
2014-09-04 21:15:50 -07:00
Matias Woloski
687ab7ae48
merge #20
2014-08-23 19:39:40 -03:00
Nico Kaiser
70579b14c8
strict check of jwt token part count (avoid "TypeError: Cannot read property 'payload' of null" in some cases)
2014-08-14 11:22:49 +02:00
Matias Woloski
64f4860623
Merge pull request #10 from luisfarzati/multiple-audiences
...
Implements multiple audiences
2014-08-05 11:25:31 -03:00
Matias Woloski
a9c6b4099a
Merge pull request #11 from luisfarzati/typed-errors
...
Throws typed error when token is expired
2014-08-05 11:24:31 -03:00
Thiago Dantas
69db3ac363
decode invalid jwt token returns null
2014-08-03 12:41:04 +01:00
Matias Woloski
dfddaa4bf5
fix security bug. JWT with alg none should fail if secretOrPulblicKey is passed
2014-07-14 16:18:05 -03:00
Luis Farzati
558ddc0c9c
throws typed error when token is expired
2014-05-31 16:39:54 -03:00
Luis Farzati
f9ebc95fb8
multiple audiences -- implements #4
2014-05-31 16:30:37 -03:00
dschenkelman
f888f4f907
Fixes for issuer and audience only being checked when they have values
2014-04-22 22:43:54 -03:00
Matias Woloski
07d163b2b1
initial
2013-06-30 22:27:13 -03:00
Alex Layton