mirror of
https://github.com/hanzoai/node-jsonwebtoken.git
synced 2026-09-24 17:00:48 +00:00
José F. Romaniello
1bb584bc38
There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family). The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`). This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.
20 lines
698 B
JavaScript
20 lines
698 B
JavaScript
var fs = require('fs');
|
|
var path = require('path');
|
|
var jwt = require('../index');
|
|
var JsonWebTokenError = require('../lib/JsonWebTokenError');
|
|
var expect = require('chai').expect;
|
|
|
|
|
|
var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'), 'utf8');
|
|
// priv is never used
|
|
// var priv = fs.readFileSync(path.join(__dirname, 'priv.pem'));
|
|
|
|
var TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIiLCJpYXQiOjE0MjY1NDY5MTl9.ETgkTn8BaxIX4YqvUWVFPmum3moNZ7oARZtSBXb_vP4';
|
|
|
|
describe('signing with pub key as symmetric', function () {
|
|
it('should not verify', function () {
|
|
expect(function () {
|
|
jwt.verify(TOKEN, pub);
|
|
}).to.throw(JsonWebTokenError, /invalid signature/);
|
|
});
|
|
}); |