hanzoai/node-jsonwebtoken
2
0
Fork 0
mirror of https://github.com/hanzoai/node-jsonwebtoken.git synced 2026-09-24 17:00:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
190 Commits 1 Branch 75 Tags
v5.5.0
Commit Graph
51 Commits
Author SHA1 Message Date
José F. Romaniello 46372e928f improvements to nbf and jti claims 2015-12-28 14:09:17 -03:00
José F. Romaniello a3c5c23f5e Merge branch 'master' of https://github.com/TATDK/node-jsonwebtoken into TATDK-master 
Conflicts:
	README.md
	index.js
 2015-12-28 13:25:39 -03:00
José F. Romaniello 39ecc6f8f3 deprecate expireInMinutes and expireInSeconds - in favor of expiresIn 2015-10-02 08:13:13 -03:00
José F. Romaniello 8e89ee4f57 Merge branch 'max-age' of https://github.com/jden/node-jsonwebtoken into jden-max-age 2015-10-02 08:07:55 -03:00
Luke William Westby 9414fbcb15 added async signing 2015-09-27 12:48:44 -05:00
José F. Romaniello 7787dd74e7 add tests for options.headers 2015-08-19 10:26:49 -03:00
jden 8078b11b22 fix spelling error in error message 2015-07-16 08:21:14 -07:00
jden 49d54e54f7 add verify option maxAge (with tests) 2015-07-15 21:48:52 -07:00
jden d7c5793d98 add tests for verify expires 2015-07-15 21:03:00 -07:00
José F. Romaniello cfe05e961c Merge branch 'empty_secretOrPublicKey' of https://github.com/JackuB/node-jsonwebtoken into JackuB-empty_secretOrPublicKey 2015-07-15 09:00:25 -03:00
TAT f26ba4e2fa Added nbf support 2015-06-26 22:46:14 +02:00
TAT ab76ec5bc5 Added support for subject and jwt id 2015-06-26 20:43:04 +02:00
Jared Hanson ba3174d100 Fix example in README, silence verbose logging. 2015-05-15 13:36:10 -07:00
Jared Hanson 7254e011b5 Add option to return header and payload when decoding. 2015-05-15 09:37:58 -07:00
Jakub Mikulas ffe68dbe02 Typo 2015-04-21 13:06:24 +02:00
Alberto Pose 9f24ffd579 Renaming header.alg mismatch exception to invalid algorithm and adding more mismatch tests. 2015-04-10 14:53:42 -03:00
Alberto Pose 1e46234201 Updating to jws@^3.0.0 
As `[email protected]` changed the verify method signature to be `jws.verify(signature, algorithm, secretOrKey)`, the token header must be decoded first in order to make sure that the `alg` field matches one of the allowed `options.algorithms`. After that, the now validated `header.alg` is passed to `jws.verify`

As the order of steps has changed, the error that was thrown when the JWT was invalid is no longer the `jws` one:

{ [Error: Invalid token: no header in signature 'a.b.c'] code: 'MISSING_HEADER', signature: 'a.b.c' }

That old error (removed from jws) has been replaced by a `JsonWebTokenError` with message `invalid token`. That's why this change will bump be a major.
 2015-04-10 12:38:41 -03:00
Jakub Mikulas d6240e2418 Removed path from test 2015-03-30 19:30:35 +02:00
Jakub Mikulas 0fdf78d4db Prevent throw on undefined/null secret 2015-03-30 19:29:25 +02:00
Alex Layton 8df6aabbc7 Fix verify for RSAPublicKey formated keys 2015-03-26 13:52:13 -04:00
José F. Romaniello 7017e74db9 fix issue when public key start with BEING PUBLIC KEY. closes #70 2015-03-17 13:16:12 -03:00
José F. Romaniello 1bb584bc38 Verification with an asymmetric key of a token signed with a symmetric key 
There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).

This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.
 2015-03-16 20:36:22 -03:00
José F. Romaniello 3b0d0b6160 add one more test 2015-03-10 13:59:38 -03:00
Andrew Balmos 5290db1bd7 First assume JWT claim set is an object 
draft-ietf-oauth-json-web-token does not require JWT objects to have typ: "JWT"
in their header. Yet it expects that the JWT's claim set be JSON for validation.
See step 10 of draft-ietf-oauth-json-web-token section 7.2 "Validating a JWT".

Prior to this commit JWTs without typ: "JWT" in header are validated without
ever checking the claim set.
 2015-03-06 16:33:05 -05:00
José F. Romaniello dd156cc30f add expiresInSeconds option to sign. closes #51 2015-03-06 12:08:38 -03:00
José F. Romaniello c7b3ab1946 remove broken test from bad merge 2015-03-06 12:01:49 -03:00
José F. Romaniello 8d4da279e1 Merge branch 'ignoreExpiration' of https://github.com/ben-bradley/node-jsonwebtoken into ben-bradley-ignoreExpiration 
Conflicts:
	README.md
	index.js
	test/jwt.hs.tests.js
 2015-03-06 11:58:12 -03:00
José F. Romaniello 6448ce3267 add test for noTimestamp 2015-03-06 11:53:05 -03:00
José F. Romaniello 1fc385ee10 allow passing encoding 2015-03-06 09:14:55 -03:00
José F. Romaniello 92d33bd99a this is a major change, it changes the default encoding from binary to utf8 2015-03-06 09:09:46 -03:00
José F. Romaniello 40f1cce24c fail verification when exp is not a number. closes #28 2014-12-29 14:20:32 -03:00
José F. Romaniello bea8a31fd0 fix error when payload is not an object. Closes #14 2014-12-29 13:29:24 -03:00
José F. Romaniello b6483581c4 fix encoding issue. closes #40 2014-12-29 13:01:12 -03:00
Ben Bradley 002cce17c0 Added option to ignore expirations in tokens 2014-12-22 12:02:04 -08:00
José F. Romaniello 4ff7b6c0a8 Merge branch 'enforce-async-sync' of https://github.com/tapayne88/node-jsonwebtoken into tapayne88-enforce-async-sync 
Conflicts:
	index.js
 2014-12-19 23:45:25 -03:00
José F. Romaniello d380a1710e Merge branch 'master' of https://github.com/mprinc/node-jsonwebtoken into mprinc-master 2014-12-19 23:41:49 -03:00
Thomas Payne 0acfe4f503 Made verify truly asynchronous or synchronous, Zalgo has been contained! 2014-12-12 16:45:19 +00:00
Joshua Perry a135caacad Add support for aud array and scalar strings Fixes #33 2014-11-25 18:42:42 -07:00
Sasha Mile Rudan 9427f35512 Fixed bug in verify function with missing options and existing callback function 2014-11-15 00:17:50 +01:00
José F. Romaniello 01ba8a8443 do not throw exception when the payload is not json. related to #14 2014-09-15 11:50:50 -03:00
Marwan Hilmi f6e5e9d10d Verifying null fix. 2014-09-04 21:15:50 -07:00
Matias Woloski 687ab7ae48 merge #20 2014-08-23 19:39:40 -03:00
Nico Kaiser 70579b14c8 strict check of jwt token part count (avoid "TypeError: Cannot read property 'payload' of null" in some cases) 2014-08-14 11:22:49 +02:00
Matias Woloski 64f4860623 Merge pull request #10 from luisfarzati/multiple-audiences 
Implements multiple audiences
 2014-08-05 11:25:31 -03:00
Matias Woloski a9c6b4099a Merge pull request #11 from luisfarzati/typed-errors 
Throws typed error when token is expired
 2014-08-05 11:24:31 -03:00
Thiago Dantas 69db3ac363 decode invalid jwt token returns null 2014-08-03 12:41:04 +01:00
Matias Woloski dfddaa4bf5 fix security bug. JWT with alg none should fail if secretOrPulblicKey is passed 2014-07-14 16:18:05 -03:00
Luis Farzati 558ddc0c9c throws typed error when token is expired 2014-05-31 16:39:54 -03:00
Luis Farzati f9ebc95fb8 multiple audiences -- implements #4 2014-05-31 16:30:37 -03:00
dschenkelman f888f4f907 Fixes for issuer and audience only being checked when they have values 2014-04-22 22:43:54 -03:00