mirror of
https://github.com/hanzoai/node-jsonwebtoken.git
synced 2026-09-24 17:00:48 +00:00
925d95de54
* Check if node version supports asymmetricKeyDetails * Validate algorithms for ec key type * Rename variable * Rename function * Add early return for symmetric keys * Validate algorithm for RSA key type * Validate algorithm for RSA-PSS key type * Check key types for EdDSA algorithm * Rename function * Move validateKey function to module * Convert arrow to function notation * Validate key in verify function * Simplify if * Convert if to switch..case * Guard against empty key in validation * Remove empty line * Add lib to check modulus length * Add modulus length checks * Validate mgf1HashAlgorithm and saltLength * Check node version before using key details API * Use built-in modulus length getter * Fix Node version validations * Remove duplicate validateKey * Add periods to error messages * Fix validation in verify function * Make asymmetric key validation the latest validation step * Change key curve validation * Remove support for ES256K * Fix old test that was using wrong key types to sign tokens * Enable RSA-PSS for old Node versions * Add specific RSA-PSS validations on Node 16 LTS+ * Improve error message * Simplify key validation code * Fix typo * Improve error message * Change var to const in test * Change const to let to avoid reassigning problem * Improve error message * Test incorrect private key type * Rename invalid to unsupported * Test verifying of jwt token with unsupported key * Test invalid private key type * Change order of object parameters * Move validation test to separate file * Move all validation tests to separate file * Add prime256v1 ec key * Remove modulus length check * WIP: Add EC key validation tests * Fix node version checks * Fix error message check on test * Add successful tests for EC curve check * Remove only from describe * Remove `only` * Remove duplicate block of code * Move variable to a different scope and make it const * Convert allowed curves to object for faster lookup * Rename variable * Change variable assignment order * Remove unused object properties * Test RSA-PSS happy path and wrong length * Add missing tests * Pass validation if no algorithm has been provided * Test validation of invalid salt length * Test error when signing token with invalid key * Change var to const/let in verify tests * Test verifying token with invalid key * Improve test error messages * Add parameter to skip private key validation * Replace DSA key with a 4096 bit long key * Test allowInvalidPrivateKeys in key signing * Improve test message * Rename variable * Add key validation flag tests * Fix variable name in Readme * Change private to public dsa key in verify * Rename flag * Run EC validation tests conditionally * Fix tests in old node versions * Ignore block of code from test coverage * Separate EC validations tests into two different ones * Add comment * Wrap switch in if instead of having an early return * Remove unsupported algorithms from asymmetric key validation * Rename option to allowInvalidAsymmetricKeyTypes and improve Readme * 9.0.0 * adding migration notes to readme * adding changelog for version 9.0.0 Co-authored-by: julienwoll <[email protected]>
67 lines
2.2 KiB
JavaScript
67 lines
2.2 KiB
JavaScript
const ASYMMETRIC_KEY_DETAILS_SUPPORTED = require('./asymmetricKeyDetailsSupported');
|
|
const RSA_PSS_KEY_DETAILS_SUPPORTED = require('./rsaPssKeyDetailsSupported');
|
|
|
|
const allowedAlgorithmsForKeys = {
|
|
'ec': ['ES256', 'ES384', 'ES512'],
|
|
'rsa': ['RS256', 'PS256', 'RS384', 'PS384', 'RS512', 'PS512'],
|
|
'rsa-pss': ['PS256', 'PS384', 'PS512']
|
|
};
|
|
|
|
const allowedCurves = {
|
|
ES256: 'prime256v1',
|
|
ES384: 'secp384r1',
|
|
ES512: 'secp521r1',
|
|
};
|
|
|
|
module.exports = function(algorithm, key) {
|
|
if (!algorithm || !key) return;
|
|
|
|
const keyType = key.asymmetricKeyType;
|
|
if (!keyType) return;
|
|
|
|
const allowedAlgorithms = allowedAlgorithmsForKeys[keyType];
|
|
|
|
if (!allowedAlgorithms) {
|
|
throw new Error(`Unknown key type "${keyType}".`);
|
|
}
|
|
|
|
if (!allowedAlgorithms.includes(algorithm)) {
|
|
throw new Error(`"alg" parameter for "${keyType}" key type must be one of: ${allowedAlgorithms.join(', ')}.`)
|
|
}
|
|
|
|
/*
|
|
* Ignore the next block from test coverage because it gets executed
|
|
* conditionally depending on the Node version. Not ignoring it would
|
|
* prevent us from reaching the target % of coverage for versions of
|
|
* Node under 15.7.0.
|
|
*/
|
|
/* istanbul ignore next */
|
|
if (ASYMMETRIC_KEY_DETAILS_SUPPORTED) {
|
|
switch (keyType) {
|
|
case 'ec':
|
|
const keyCurve = key.asymmetricKeyDetails.namedCurve;
|
|
const allowedCurve = allowedCurves[algorithm];
|
|
|
|
if (keyCurve !== allowedCurve) {
|
|
throw new Error(`"alg" parameter "${algorithm}" requires curve "${allowedCurve}".`);
|
|
}
|
|
break;
|
|
|
|
case 'rsa-pss':
|
|
if (RSA_PSS_KEY_DETAILS_SUPPORTED) {
|
|
const length = parseInt(algorithm.slice(-3), 10);
|
|
const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
|
|
|
|
if (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm) {
|
|
throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${algorithm}.`);
|
|
}
|
|
|
|
if (saltLength !== undefined && saltLength > length >> 3) {
|
|
throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.`)
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
}
|