Skip to content

Commit 53c3987

Browse files
jfromaniellojfromaniello
committed
Improved the sign method
Notable changes: 1. `expiresInMinutes` and `expiresInSeconds` are deprecated and no longer supported. 2. `notBeforeInMinutes` and `notBeforeInSeconds` are deprecated and no longer supported. 3. options are properly validated. 4. `options.expiresIn`, `options.notBefore`, `options.audience`, `options.issuer`, `options.subject` and `options.jwtid` are mutually exclusive with `payload.exp`, `payload.nbf`, `payload.aud`, `payload.iss`, `payload.sub` and `payload.jti` respectively. 5. `options.algorithm` is properly validated. 6. `options.headers` is renamed to `options.header`.
1 parent e32043b commit 53c3987

10 files changed

+132
-143
lines changed

‎README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ encoded private key for RSA and ECDSA.
2626

2727
`options`:
2828

29-
* `algorithm` (default: `HS256`)
29+
* `algorithm` or `alg` (default: `HS256`)
3030
* `expiresIn`: expressed in seconds or a string describing a time span [rauchg/ms](https://github.com/rauchg/ms.js). Eg: `60`, `"2 days"`, `"10h"`, `"7d"`
3131
* `notBefore`: expressed in seconds or a string describing a time span [rauchg/ms](https://github.com/rauchg/ms.js). Eg: `60`, `"2 days"`, `"10h"`, `"7d"`
3232
* `audience`
@@ -35,16 +35,16 @@ encoded private key for RSA and ECDSA.
3535
* `jwtid`
3636
* `subject`
3737
* `noTimestamp`
38-
* `headers`
38+
* `header`
3939

40-
If `payload` is not a buffer or a string, it will be coerced into a string
41-
using `JSON.stringify`.
40+
If `payload` is not a buffer or a string, it will be coerced into a string using `JSON.stringify`.
4241

43-
If any `expiresIn`, `notBeforeMinutes`, `audience`, `subject`, `issuer` are not provided, there is no default. The jwt generated won't include those properties in the payload.
42+
There are no default values for `expiresIn`, `notBefore`, `audience`, `subject`, `issuer`. These claims can also be provided in the payload directly with `exp`, `nbf`, `aud` and `sub` respectively, but you can't include in both places.
4443

45-
Additional headers can be provided via the `headers` object.
4644

47-
Generated jwts will include an `iat` claim by default unless `noTimestamp` is specified.
45+
The header can be customized via the `option.header` object.
46+
47+
Generated JWTs will include an `iat` claim by default unless `noTimestamp` is specified.
4848

4949
Example
5050

‎index.js

+1-109
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
var jws = require('jws');
22
var ms = require('ms');
3-
var timespan = require('./lib/timespan');
4-
var xtend = require('xtend');
5-
63
var JWT = module.exports;
74

85
var JsonWebTokenError = JWT.JsonWebTokenError = require('./lib/JsonWebTokenError');
@@ -38,112 +35,7 @@ JWT.decode = function (jwt, options) {
3835
return payload;
3936
};
4037

41-
var payload_options = [
42-
'expiresIn',
43-
'notBefore',
44-
'expiresInMinutes',
45-
'expiresInSeconds',
46-
'audience',
47-
'issuer',
48-
'subject',
49-
'jwtid'
50-
];
51-
52-
JWT.sign = function(payload, secretOrPrivateKey, options, callback) {
53-
options = options || {};
54-
var header = {};
55-
56-
if (typeof payload === 'object') {
57-
header.typ = 'JWT';
58-
payload = xtend(payload);
59-
} else {
60-
var invalid_option = payload_options.filter(function (key) {
61-
return typeof options[key] !== 'undefined';
62-
})[0];
63-
64-
if (invalid_option) {
65-
console.warn('invalid "' + invalid_option + '" option for ' + (typeof payload) + ' payload');
66-
}
67-
}
68-
69-
if (typeof payload.exp !== 'undefined' && typeof options.expiresIn !== 'undefined') {
70-
throw new Error('Bad "options.expiresIn" option the payload already has an "exp" property.');
71-
}
72-
73-
header.alg = options.algorithm || 'HS256';
74-
75-
if (options.headers) {
76-
Object.keys(options.headers).forEach(function (k) {
77-
header[k] = options.headers[k];
78-
});
79-
}
80-
81-
var timestamp = Math.floor(Date.now() / 1000);
82-
if (!options.noTimestamp) {
83-
payload.iat = payload.iat || timestamp;
84-
}
85-
86-
if (typeof options.notBefore !== 'undefined') {
87-
payload.nbf = timespan(options.notBefore);
88-
if (typeof payload.nbf === 'undefined') {
89-
throw new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60');
90-
}
91-
}
92-
93-
if (options.expiresInSeconds || options.expiresInMinutes) {
94-
var deprecated_line;
95-
try {
96-
deprecated_line = /.*\((.*)\).*/.exec((new Error()).stack.split('\n')[2])[1];
97-
} catch(err) {
98-
deprecated_line = '';
99-
}
100-
101-
console.warn('jsonwebtoken: expiresInMinutes and expiresInSeconds is deprecated. (' + deprecated_line + ')\n' +
102-
'Use "expiresIn" expressed in seconds.');
103-
104-
var expiresInSeconds = options.expiresInMinutes ?
105-
options.expiresInMinutes * 60 :
106-
options.expiresInSeconds;
107-
108-
payload.exp = timestamp + expiresInSeconds;
109-
} else if (typeof options.expiresIn !== 'undefined' && typeof payload === 'object') {
110-
payload.exp = timespan(options.expiresIn);
111-
if (typeof payload.exp === 'undefined') {
112-
throw new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60');
113-
}
114-
}
115-
116-
if (options.audience)
117-
payload.aud = options.audience;
118-
119-
if (options.issuer)
120-
payload.iss = options.issuer;
121-
122-
if (options.subject)
123-
payload.sub = options.subject;
124-
125-
if (options.jwtid)
126-
payload.jti = options.jwtid;
127-
128-
var encoding = 'utf8';
129-
if (options.encoding) {
130-
encoding = options.encoding;
131-
}
132-
133-
if(typeof callback === 'function') {
134-
jws.createSign({
135-
header: header,
136-
privateKey: secretOrPrivateKey,
137-
payload: JSON.stringify(payload)
138-
})
139-
.on('error', callback)
140-
.on('done', function(signature) {
141-
callback(null, signature);
142-
});
143-
} else {
144-
return jws.sign({header: header, payload: payload, secret: secretOrPrivateKey, encoding: encoding});
145-
}
146-
};
38+
JWT.sign = require('./sign');
14739

14840
JWT.verify = function(jwtString, secretOrPublicKey, options, callback) {
14941
if ((typeof options === 'function') && !callback) {

‎package.json

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
"url": "https://github.com/auth0/node-jsonwebtoken/issues"
2020
},
2121
"dependencies": {
22+
"joi": "~8.0.5",
2223
"jws": "^3.0.0",
2324
"ms": "^0.7.1",
2425
"xtend": "^4.0.1"

‎sign.js

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
var Joi = require('joi');
2+
var timespan = require('./lib/timespan');
3+
var xtend = require('xtend');
4+
var jws = require('jws');
5+
6+
var sign_options_schema = Joi.object().keys({
7+
expiresIn: [Joi.number().integer(), Joi.string()],
8+
notBefore: [Joi.number().integer(), Joi.string()],
9+
audience: [Joi.string(), Joi.array()],
10+
algorithm: Joi.string().valid('RS256','RS384','RS512','ES256','ES384','ES512','HS256','HS384','HS512','none'),
11+
header: Joi.object(),
12+
encoding: Joi.string(),
13+
issuer: Joi.string(),
14+
subject: Joi.string(),
15+
jwtid: Joi.string(),
16+
noTimestamp: Joi.boolean()
17+
});
18+
19+
var options_to_payload = {
20+
'audience': 'aud',
21+
'issuer': 'iss',
22+
'subject': 'sub',
23+
'jwtid': 'jti'
24+
};
25+
26+
module.exports = function(payload, secretOrPrivateKey, options, callback) {
27+
options = options || {};
28+
29+
var header = xtend({
30+
alg: options.algorithm || 'HS256',
31+
typ: typeof payload === 'object' ? 'JWT' : undefined
32+
}, options.header);
33+
34+
if (typeof payload === 'undefined') {
35+
throw new Error('payload is required');
36+
} else if (typeof payload === 'object') {
37+
payload = xtend(payload);
38+
}
39+
40+
if (typeof payload.exp !== 'undefined' && typeof options.expiresIn !== 'undefined') {
41+
throw new Error('Bad "options.expiresIn" option the payload already has an "exp" property.');
42+
}
43+
44+
if (typeof payload.nbf !== 'undefined' && typeof options.notBefore !== 'undefined') {
45+
throw new Error('Bad "options.notBefore" option the payload already has an "nbf" property.');
46+
}
47+
48+
var validation_result = sign_options_schema.validate(options);
49+
50+
if (validation_result.error) {
51+
throw validation_result.error;
52+
}
53+
54+
var timestamp = payload.iat || Math.floor(Date.now() / 1000);
55+
56+
if (!options.noTimestamp) {
57+
payload.iat = timestamp;
58+
} else {
59+
delete payload.iat;
60+
}
61+
62+
if (typeof options.notBefore !== 'undefined') {
63+
payload.nbf = timespan(options.notBefore);
64+
if (typeof payload.nbf === 'undefined') {
65+
throw new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60');
66+
}
67+
}
68+
69+
if (typeof options.expiresIn !== 'undefined' && typeof payload === 'object') {
70+
payload.exp = timespan(options.expiresIn);
71+
if (typeof payload.exp === 'undefined') {
72+
throw new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60');
73+
}
74+
}
75+
76+
Object.keys(options_to_payload).forEach(function (key) {
77+
var claim = options_to_payload[key];
78+
if (typeof options[key] !== 'undefined' && typeof payload[claim] !== 'undefined') {
79+
throw new Error('Bad "options.' + key + '" option. The payload already has an "' + claim + '" property.');
80+
}
81+
payload[claim] = options[key];
82+
});
83+
84+
var encoding = options.encoding || 'utf8';
85+
86+
if(typeof callback === 'function') {
87+
jws.createSign({
88+
header: header,
89+
privateKey: secretOrPrivateKey,
90+
payload: JSON.stringify(payload),
91+
encoding: encoding
92+
})
93+
.once('error', callback)
94+
.once('done', function(signature) {
95+
callback(null, signature);
96+
});
97+
} else {
98+
return jws.sign({header: header, payload: payload, secret: secretOrPrivateKey, encoding: encoding});
99+
}
100+
};

‎test/async_sign.tests.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@ describe('signing a token asynchronously', function() {
1919
});
2020

2121
it('should throw error', function(done) {
22-
jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS2561' }, function (err) {
22+
//this throw an error because the secret is not a cert and RS256 requires a cert.
23+
jwt.sign({ foo: 'bar' }, secret, { algorithm: 'RS256' }, function (err) {
2324
expect(err).to.be.ok();
2425
done();
2526
});

‎test/expiresInSeconds.tests.js

-12
This file was deleted.

‎test/expires_format.tests.js

+9-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ describe('expires option', function() {
3333
it('should throw if expires is not an string or number', function () {
3434
expect(function () {
3535
jwt.sign({foo: 123}, '123', { expiresIn: { crazy : 213 } });
36-
}).to.throw(/"expiresIn" should be a number of seconds or string representing a timespan/);
36+
}).to.throw(/"expiresIn" must be a number/);
3737
});
3838

3939
it('should throw an error if expiresIn and exp are provided', function () {
@@ -42,4 +42,12 @@ describe('expires option', function() {
4242
}).to.throw(/Bad "options.expiresIn" option the payload already has an "exp" property./);
4343
});
4444

45+
46+
it('should throw on deprecated expiresInSeconds option', function () {
47+
expect(function () {
48+
jwt.sign({foo: 123}, '123', { expiresInSeconds: 5 });
49+
}).to.throw('"expiresInSeconds" is not allowed');
50+
});
51+
52+
4553
});

‎test/jwt.rs.tests.js

+5-6
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ var path = require('path');
44

55
var expect = require('chai').expect;
66
var assert = require('chai').assert;
7+
var ms = require('ms');
78

89
describe('RS256', function() {
910
var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'));
@@ -52,7 +53,7 @@ describe('RS256', function() {
5253
});
5354

5455
describe('when signing a token with expiration', function() {
55-
var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresInMinutes: 10 });
56+
var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresIn: '10m' });
5657

5758
it('should be valid expiration', function(done) {
5859
jwt.verify(token, pub, function(err, decoded) {
@@ -64,7 +65,7 @@ describe('RS256', function() {
6465

6566
it('should be invalid', function(done) {
6667
// expired token
67-
token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresInMinutes: -10 });
68+
token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresIn: -1 * ms('10m') });
6869

6970
jwt.verify(token, pub, function(err, decoded) {
7071
assert.isUndefined(decoded);
@@ -78,7 +79,7 @@ describe('RS256', function() {
7879

7980
it('should NOT be invalid', function(done) {
8081
// expired token
81-
token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresInMinutes: -10 });
82+
token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresIn: -1 * ms('10m') });
8283

8384
jwt.verify(token, pub, { ignoreExpiration: true }, function(err, decoded) {
8485
assert.ok(decoded.foo);
@@ -93,8 +94,6 @@ describe('RS256', function() {
9394

9495
it('should be valid expiration', function(done) {
9596
jwt.verify(token, pub, function(err, decoded) {
96-
console.log(token);
97-
console.dir(arguments);
9897
assert.isNotNull(decoded);
9998
assert.isNull(err);
10099
done();
@@ -131,7 +130,7 @@ describe('RS256', function() {
131130

132131
it('should NOT be invalid', function(done) {
133132
// not active token
134-
token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', notBeforeMinutes: 10 });
133+
token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', notBefore: '10m' });
135134

136135
jwt.verify(token, pub, { ignoreNotBefore: true }, function(err, decoded) {
137136
assert.ok(decoded.foo);

‎test/noTimestamp.tests.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ var expect = require('chai').expect;
44
describe('noTimestamp', function() {
55

66
it('should work with string', function () {
7-
var token = jwt.sign({foo: 123}, '123', { expiresInMinutes: 5 , noTimestamp: true });
7+
var token = jwt.sign({foo: 123}, '123', { expiresIn: '5m' , noTimestamp: true });
88
var result = jwt.verify(token, '123');
99
expect(result.exp).to.be.closeTo(Math.floor(Date.now() / 1000) + (5*60), 0.5);
1010
});
1111

12-
});
12+
});

0 commit comments

Comments
 (0)