Skip to content

Commit d01cc7b

Browse files
JacoKosterziluvatar
JacoKoster
authored and
ziluvatar
committed
Secret callback revisited (#480)
* Introduction of the secret callback Without the more contentious 'none'-changes * Removed some spaces... I should really add a editor.config and eslint to this project ;-) * Removed xtend as a dependency, as the native Object.Assign can do this as well * Removed xtend as a dependency, as the native Object.Assign can do this as well * Resolve feedback from review * Added extra test and fixed the associated bug * The return of the header * Forgot to change this one as well... Sorry bout that * Updated the readme and made the if-statements consistent * Space; The final frontier
1 parent 73c4a5a commit d01cc7b

8 files changed

+234
-104
lines changed

‎.editorconfig

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[*]
2+
indent_style = space
3+
indent_size = 2

‎.eslintrc

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"env": {
3+
"es6": true
4+
},
5+
"rules": {
6+
"indent": [2,2]
7+
}
8+
}

‎README.md

+18
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ jwt.sign({
122122

123123
`secretOrPublicKey` is a string or buffer containing either the secret for HMAC algorithms, or the PEM
124124
encoded public key for RSA and ECDSA.
125+
If `jwt.verify` is called asynchronous, `secretOrPublicKey` can be a function that should fetch the secret or public key. See below for a detailed example
125126

126127
As mentioned in [this comment](https://github.com/auth0/node-jsonwebtoken/issues/208#issuecomment-231861138), there are other libraries that expect base64 encoded secrets (random bytes encoded using base64), if that is your case you can pass `Buffer.from(secret, 'base64')`, by doing this the secret will be decoded using base64 and the token verification will use the original random bytes.
127128

@@ -197,6 +198,23 @@ jwt.verify(token, cert, { algorithms: ['RS256'] }, function (err, payload) {
197198
// if token alg != RS256, err == invalid signature
198199
});
199200

201+
// Verify using getKey callback
202+
// Example uses https://github.com/auth0/node-jwks-rsa as a way to fetch the keys.
203+
var jwksClient = require('jwks-rsa');
204+
var client = jwksClient({
205+
jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json'
206+
});
207+
function getKey(header, callback){
208+
client.getSigningKey(header.kid, function(err, key) {
209+
var signingKey = key.publicKey || key.rsaPublicKey;
210+
callback(null, signingKey);
211+
});
212+
}
213+
214+
jwt.verify(token, getKey, options, function(err, decoded) {
215+
console.log(decoded.foo) // bar
216+
});
217+
200218
```
201219

202220
### jwt.decode(token [, options])

‎package.json

+1-2
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,7 @@
2727
"lodash.isplainobject": "^4.0.6",
2828
"lodash.isstring": "^4.0.1",
2929
"lodash.once": "^4.0.0",
30-
"ms": "^2.1.1",
31-
"xtend": "^4.0.1"
30+
"ms": "^2.1.1"
3231
},
3332
"devDependencies": {
3433
"atob": "^1.1.2",

‎sign.js

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
var timespan = require('./lib/timespan');
2-
var xtend = require('xtend');
32
var jws = require('jws');
43
var includes = require('lodash.includes');
54
var isBoolean = require('lodash.isboolean');
@@ -85,7 +84,7 @@ module.exports = function (payload, secretOrPrivateKey, options, callback) {
8584
var isObjectPayload = typeof payload === 'object' &&
8685
!Buffer.isBuffer(payload);
8786

88-
var header = xtend({
87+
var header = Object.assign({
8988
alg: options.algorithm || 'HS256',
9089
typ: isObjectPayload ? 'JWT' : undefined,
9190
kid: options.keyid
@@ -112,7 +111,7 @@ module.exports = function (payload, secretOrPrivateKey, options, callback) {
112111
return failure(error);
113112
}
114113
if (!options.mutatePayload) {
115-
payload = xtend(payload);
114+
payload = Object.assign({},payload);
116115
}
117116
} else {
118117
var invalid_options = options_for_objects.filter(function (opt) {

‎test/keyid.tests.js

+4-4
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ var jwt = require('../index');
22

33
var claims = {"name": "doron", "age": 46};
44
jwt.sign(claims, 'secret', {"keyid": "1234"}, function(err, good) {
5-
console.log(jwt.decode(good, {"complete": true}).header.kid);
6-
jwt.verify(good, 'secret', function(err, result) {
7-
console.log(result);
8-
})
5+
console.log(jwt.decode(good, {"complete": true}).header.kid);
6+
jwt.verify(good, 'secret', function(err, result) {
7+
console.log(result);
8+
})
99
});

‎test/verify.tests.js

+89-3
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@ var jws = require('jws');
33
var fs = require('fs');
44
var path = require('path');
55
var sinon = require('sinon');
6+
var JsonWebTokenError = require('../lib/JsonWebTokenError');
67

78
var assert = require('chai').assert;
9+
var expect = require('chai').expect;
810

911
describe('verify', function() {
1012
var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'));
@@ -16,9 +18,9 @@ describe('verify', function() {
1618

1719
var signed = jws.sign({
1820
header: header,
19-
payload: payload,
20-
secret: priv,
21-
encoding: 'utf8'
21+
payload: payload,
22+
secret: priv,
23+
encoding: 'utf8'
2224
});
2325

2426
jwt.verify(signed, pub, {typ: 'JWT'}, function(err, p) {
@@ -67,6 +69,90 @@ describe('verify', function() {
6769
});
6870
});
6971

72+
describe('secret or token as callback', function () {
73+
var token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJpYXQiOjE0MzcwMTg1ODIsImV4cCI6MTQzNzAxODU5Mn0.3aR3vocmgRpG05rsI9MpR6z2T_BGtMQaPq2YR6QaroU';
74+
var key = 'key';
75+
76+
var payload = { foo: 'bar', iat: 1437018582, exp: 1437018592 };
77+
var options = {algorithms: ['HS256'], ignoreExpiration: true};
78+
79+
it('without callback', function (done) {
80+
jwt.verify(token, key, options, function (err, p) {
81+
assert.isNull(err);
82+
assert.deepEqual(p, payload);
83+
done();
84+
});
85+
});
86+
87+
it('simple callback', function (done) {
88+
var keyFunc = function(header, callback) {
89+
assert.deepEqual(header, { alg: 'HS256', typ: 'JWT' });
90+
91+
callback(undefined, key);
92+
};
93+
94+
jwt.verify(token, keyFunc, options, function (err, p) {
95+
assert.isNull(err);
96+
assert.deepEqual(p, payload);
97+
done();
98+
});
99+
});
100+
101+
it('should error if called synchronously', function (done) {
102+
var keyFunc = function(header, callback) {
103+
callback(undefined, key);
104+
};
105+
106+
expect(function () {
107+
jwt.verify(token, keyFunc, options);
108+
}).to.throw(JsonWebTokenError, /verify must be called asynchronous if secret or public key is provided as a callback/);
109+
110+
done();
111+
});
112+
113+
it('simple error', function (done) {
114+
var keyFunc = function(header, callback) {
115+
callback(new Error('key not found'));
116+
};
117+
118+
jwt.verify(token, keyFunc, options, function (err, p) {
119+
assert.equal(err.name, 'JsonWebTokenError');
120+
assert.match(err.message, /error in secret or public key callback/);
121+
assert.isUndefined(p);
122+
done();
123+
});
124+
});
125+
126+
it('delayed callback', function (done) {
127+
var keyFunc = function(header, callback) {
128+
setTimeout(function() {
129+
callback(undefined, key);
130+
}, 25);
131+
};
132+
133+
jwt.verify(token, keyFunc, options, function (err, p) {
134+
assert.isNull(err);
135+
assert.deepEqual(p, payload);
136+
done();
137+
});
138+
});
139+
140+
it('delayed error', function (done) {
141+
var keyFunc = function(header, callback) {
142+
setTimeout(function() {
143+
callback(new Error('key not found'));
144+
}, 25);
145+
};
146+
147+
jwt.verify(token, keyFunc, options, function (err, p) {
148+
assert.equal(err.name, 'JsonWebTokenError');
149+
assert.match(err.message, /error in secret or public key callback/);
150+
assert.isUndefined(p);
151+
done();
152+
});
153+
});
154+
});
155+
70156
describe('expiration', function () {
71157
// { foo: 'bar', iat: 1437018582, exp: 1437018592 }
72158
var token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJpYXQiOjE0MzcwMTg1ODIsImV4cCI6MTQzNzAxODU5Mn0.3aR3vocmgRpG05rsI9MpR6z2T_BGtMQaPq2YR6QaroU';

0 commit comments

Comments
 (0)