hanzoai/node-jsonwebtoken
2
0
Fork 0
mirror of https://github.com/hanzoai/node-jsonwebtoken.git synced 2026-09-24 17:00:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
386 Commits 1 Branch 75 Tags
v8.2.2
Commit Graph
97 Commits
Author SHA1 Message Date
Nicolas CognauxandEduardo Diaz e50764b070 Check payload is not null when decoded. (#444) 
* Check payload is not null when decoded.
Fixed "Cannot read property 'nbf' of null"

* Condition on obj !== null for clarity

* Added test for decoding null token
 2018-04-05 13:28:41 +02:00
Jonathan Gros-DuboisandEduardo Diaz cab1c43ee4 Add a new mutatePayload option (#446) 
This option allows you to keep a reference to the raw token payload after claims have been applied to it but before it has been encoded.
 2018-03-02 13:48:25 +01:00
Tim OramandEduardo Diaz 9f9d93b40e Not Before (nbf) calculated based on iat/timestamp (#437) 
fix #435
 2018-01-19 18:28:49 +01:00
TheBusCantSwimandEduardo Diaz 5193ee5616 Enhance audience check to verify against regular expressions (#398) 
* Enhance audience check to verify against regular expressions

* Enhance audience check to verify against regular expressions

* Adapted README to have a showcase of the new RegExp-check for the audience validation
 2017-10-09 19:29:15 +02:00
Fredrik LiljegrenandGitHub 3f2bff62d4 Merge pull request #349 from ziluvatar/fix-max-age-number-and-seconds 
maxAge: Fix logic with number + use seconds instead of ms
 2017-09-06 16:43:23 +02:00
Chris PriceandEduardo Diaz 75b897b11d Remove joi to shrink module size (#348) 
* Add cost-of-modules report to npm test

Results before any changes

┌─────────────┬────────────┬───────┐
│ name        │ children   │ size  │
├─────────────┼────────────┼───────┤
│ joi         │ 4          │ 3.12M │ <--!!!
├─────────────┼────────────┼───────┤
│ jws         │ 5          │ 0.18M │
├─────────────┼────────────┼───────┤
│ lodash.once │ 0          │ 0.01M │
├─────────────┼────────────┼───────┤
│ ms          │ 0          │ 0.01M │
├─────────────┼────────────┼───────┤
│ xtend       │ 0          │ 0.00M │
├─────────────┼────────────┼───────┤
│ 5 modules   │ 9 children │ 3.32M │
└─────────────┴────────────┴───────┘

* Replace joi with bespoke validator based on lodash

Dramatically reduces the module size without breaking ES5 compatability -

┌──────────────────────┬────────────┬───────┐
│ name                 │ children   │ size  │
├──────────────────────┼────────────┼───────┤
│ jws                  │ 5          │ 0.18M │
├──────────────────────┼────────────┼───────┤
│ lodash.includes      │ 0          │ 0.02M │
├──────────────────────┼────────────┼───────┤
│ lodash.once          │ 0          │ 0.01M │
├──────────────────────┼────────────┼───────┤
│ lodash.isinteger     │ 0          │ 0.01M │
├──────────────────────┼────────────┼───────┤
│ ms                   │ 0          │ 0.01M │
├──────────────────────┼────────────┼───────┤
│ lodash.isplainobject │ 0          │ 0.01M │
├──────────────────────┼────────────┼───────┤
│ xtend                │ 0          │ 0.00M │
├──────────────────────┼────────────┼───────┤
│ lodash.isstring      │ 0          │ 0.00M │
├──────────────────────┼────────────┼───────┤
│ lodash.isboolean     │ 0          │ 0.00M │
├──────────────────────┼────────────┼───────┤
│ lodash.isnumber      │ 0          │ 0.00M │
├──────────────────────┼────────────┼───────┤
│ lodash.isarray       │ 0          │ 0.00M │
├──────────────────────┼────────────┼───────┤
│ 11 modules           │ 5 children │ 0.25M │
└──────────────────────┴────────────┴───────┘

* Enhance validator error messages and add tests
 2017-09-06 16:24:55 +02:00
Eduardo Diaz 23cb6f1d24 maxAge: Add validation to timespan result 2017-08-29 12:24:08 +02:00
Eduardo Diaz d63c87dc7c add test & modify guard code 2017-08-17 13:50:26 +02:00
Rhys Anthony McCaig 7ff56f77f3 Fixed alg non + secret set unit test 2017-08-11 17:32:06 -07:00
Rhys Anthony McCaig 95e73a269a Fix for #381. Set secret string before using jws when alg is none 2017-08-11 17:25:55 -07:00
Eduardo Diaz 4cc2615033 sign: add check to be sure secret has a value 2017-07-24 16:59:07 -05:00
Eduardo Diaz 7ca537e2bf Add tests for ES256 2017-06-11 13:18:50 +02:00
Eduardo Diaz 543bf7f71d maxAge: Fix logic with number + use seconds instead of ms 2017-05-13 17:29:19 +02:00
Eduardo Diaz 87d9e777ed Make Options object optional for callback-ish sign 2017-03-08 14:09:04 +01:00
Michael BorstandEduardo Diaz 912e40685f Allow user to specify now. (#274) 2017-02-10 19:27:44 +01:00
Sergey MaslyakovandEduardo Diaz 047f1ae04b Raise jws.decode error to avoid confusion with "invalid token" error (#294) 
* Corrected indistinguishable error messages

jws.decode() never throws an error. At least, in its current version. However, if it were to throw an exception, the diagnostics would be indistinguishable from a soft failure to decode a token. I had an extra trailing space on my JWT and it took me some additional debugging work to trace the actual root cause because the error message was not distinct.

* Allowed an exception from inside of jws.decode to be handled by the caller. Currently, jws.decode never throws an exception. The change is made per discsussion in the original PR

* Added a test case and proper forwarding of the possible exception thrown from jws.decode

* Typo correction
 2017-02-09 13:54:58 +01:00
Ricardo GamaandEduardo Diaz c4f7670972 Fix handling non string tokens (#305) 2017-02-03 21:07:54 +01:00
Ryan Parman 2f220de780 Simpler PR which implements the changes from #249. 2016-11-28 11:50:37 -08:00
José F. Romaniello d06359ef3b Revert "Merge branch 'venatir-master'" 
This reverts commit d66d4ebd3e, reversing
changes made to 5117aacd01.
 2016-08-11 13:22:15 -03:00
Mircea Danila Dumitrescu 01903bcdc6 Fixed tests, however typ: 'JWT' should not be in the options at all, so please review other tests 2016-08-10 11:33:45 +01:00
José F. Romaniello 6b50ff324b fix issue with buffer payload. closes #216 2016-07-15 09:32:35 -03:00
José F. Romaniello 758ca5eeca temporarly fix an issue of double callback in JWS 2016-07-14 17:30:25 -03:00
José F. Romaniello bece881609 add redundant test 2016-07-14 17:18:41 -03:00
José F. Romaniello 084f537d3d do not stringify the payload when signing async - closes #224 2016-07-12 10:06:23 -03:00
José F. Romaniello 63263a28a2 do not mutate options in jwt.verify, closes #227 2016-07-12 09:52:32 -03:00
José F. Romaniello e11d505207 refactor into multiple files 2016-07-12 09:49:04 -03:00
lusarz 757a16e0e3 Exp calculated based on iat. fix #217 2016-06-22 10:42:23 +02:00
José F. Romaniello 1e46c5a42a change jwt.sign to return errors on callback instead of throwing errors 2016-05-19 12:47:24 -03:00
José F. Romaniello 65ddea934f Merge branch 'origin/clock_skew_tolerance' of https://github.com/jacopofar/node-jsonwebtoken into jacopofar-origin/clock_skew_tolerance 2016-04-29 11:30:21 -03:00
José F. Romaniello 7b0981380d improve async test 2016-04-29 08:54:48 -03:00
José F. Romaniello b51e31f477 include standard claims from payload. closes #196 2016-04-28 19:55:05 -03:00
José F. Romaniello 7b0ba50bb9 Merge branch 'verify-unsigned-tokens' of https://github.com/jonekdahl/node-jsonwebtoken into jonekdahl-verify-unsigned-tokens 2016-04-27 13:22:07 -03:00
José F. Romaniello 304f1b3307 throw error on invalid options when the payload is not an object 2016-04-27 12:49:54 -03:00
José F. Romaniello 53c3987b3c Improved the sign method 
Notable changes:

1.  `expiresInMinutes` and `expiresInSeconds` are deprecated and no longer supported.
2.  `notBeforeInMinutes` and `notBeforeInSeconds` are deprecated and no longer supported.
3.  options are properly validated.
4.  `options.expiresIn`, `options.notBefore`, `options.audience`, `options.issuer`, `options.subject` and `options.jwtid` are mutually exclusive with `payload.exp`, `payload.nbf`, `payload.aud`, `payload.iss`, `payload.sub` and `payload.jti` respectively.
5.  `options.algorithm` is properly validated.
6.  `options.headers` is renamed to `options.header`.
 2016-04-27 12:40:28 -03:00
José F. Romaniello e32043b8e9 make payload.exp and options.expiresIn exclusive 2016-04-27 11:43:22 -03:00
popomore 50873c7d45 feat: change .sign to standard async callback 
- subscribe error event
- change the first argument of the callback as error
 2016-04-27 17:24:51 +08:00
Jon Ekdahl 0f193887d3 Fix verification of unsigned tokens (fix #185) 2016-04-12 21:38:43 +02:00
Jacopo ac7e6a6a4a use the same timestamp in sync and async 2016-03-25 22:35:53 +01:00
jacopo_farina 08a5ff5836 add test for clockTolerance 2016-03-25 00:39:03 +01:00
jacopo_farina 649f4d9017 add tests about iat payload validation 2016-03-25 00:12:05 +01:00
José F. Romaniello 39d9309ae0 add support for validating multiples issuers. closes #163 2016-02-16 09:23:39 -03:00
Adam BarrettandJosé F. Romaniello 8aedf2b1f5 Fix tests in jwt.rs.tests.js which causes 4 to fail 2016-02-16 08:48:43 -03:00
José F. Romaniello 71200f14de add a console.warn on invalid options for string payloads 2016-01-04 09:30:01 -03:00
José F. Romaniello 65b1f58038 minor 2016-01-04 09:16:57 -03:00
José F. Romaniello be9c09af83 fix signing method with sealed objects, do not modify the params object. closes #147 2016-01-04 09:05:57 -03:00
José F. Romaniello 786d37b299 fix nbf verification. fix #152 2016-01-04 08:53:25 -03:00
José F. Romaniello 46372e928f improvements to nbf and jti claims 2015-12-28 14:09:17 -03:00
José F. Romaniello a3c5c23f5e Merge branch 'master' of https://github.com/TATDK/node-jsonwebtoken into TATDK-master 
Conflicts:
	README.md
	index.js
 2015-12-28 13:25:39 -03:00
José F. Romaniello 39ecc6f8f3 deprecate expireInMinutes and expireInSeconds - in favor of expiresIn 2015-10-02 08:13:13 -03:00
José F. Romaniello 8e89ee4f57 Merge branch 'max-age' of https://github.com/jden/node-jsonwebtoken into jden-max-age 2015-10-02 08:07:55 -03:00