mirror of
https://github.com/hanzoai/node-jsonwebtoken.git
synced 2026-09-24 17:00:48 +00:00
Andrew Balmos
5290db1bd7
draft-ietf-oauth-json-web-token does not require JWT objects to have typ: "JWT" in their header. Yet it expects that the JWT's claim set be JSON for validation. See step 10 of draft-ietf-oauth-json-web-token section 7.2 "Validating a JWT". Prior to this commit JWTs without typ: "JWT" in header are validated without ever checking the claim set.
29 lines
738 B
JavaScript
29 lines
738 B
JavaScript
var jwt = require('../index');
|
|
var jws = require('jws');
|
|
var fs = require('fs');
|
|
var path = require('path');
|
|
|
|
var assert = require('chai').assert;
|
|
|
|
describe('verify', function() {
|
|
var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'));
|
|
var priv = fs.readFileSync(path.join(__dirname, 'priv.pem'));
|
|
|
|
it('should first assume JSON claim set', function () {
|
|
var header = { alg: 'RS256' };
|
|
var payload = { iat: Math.floor(Date.now() / 1000 ) };
|
|
|
|
var signed = jws.sign({
|
|
header: header,
|
|
payload: payload,
|
|
secret: priv,
|
|
encoding: 'utf8'
|
|
});
|
|
|
|
jwt.verify(signed, pub, {typ: 'JWT'}, function(err, p) {
|
|
assert.isNull(err);
|
|
assert.deepEqual(p, payload);
|
|
});
|
|
});
|
|
});
|