José F. Romaniello 1bb584bc38 Verification with an asymmetric key of a token signed with a symmetric key ...

There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).

This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.

2015-03-16 20:36:22 -03:00

..

encoding.tests.js

allow passing encoding

2015-03-06 09:14:55 -03:00

expiresInSeconds.tests.js

add expiresInSeconds option to sign. closes #51

2015-03-06 12:08:38 -03:00

invalid_exp.tests.js

fail verification when exp is not a number. closes #28

2014-12-29 14:20:32 -03:00

invalid_pub.pem

initial

2013-06-30 22:27:13 -03:00

jwt.hs.tests.js

remove broken test from bad merge

2015-03-06 12:01:49 -03:00

jwt.rs.tests.js

Added option to ignore expirations in tokens

2014-12-22 12:02:04 -08:00

non_object_values.tests.js

add one more test

2015-03-10 13:59:38 -03:00

noTimestamp.tests.js

add test for noTimestamp

2015-03-06 11:53:05 -03:00

priv.pem

initial

2013-06-30 22:27:13 -03:00

pub.pem

initial

2013-06-30 22:27:13 -03:00

verify.tests.js

First assume JWT claim set is an object

2015-03-06 16:33:05 -05:00

wrong_alg.tests.js

Verification with an asymmetric key of a token signed with a symmetric key

2015-03-16 20:36:22 -03:00