Skip to content

Commit eefb9d9

Browse files
panvaziluvatar
panva
authored and
ziluvatar
committed
feat: add PS JWA support for applicable node versions (#573)
1 parent 8737789 commit eefb9d9

11 files changed

+86
-12
lines changed

‎.travis.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
language: node_js
22
sudo: false
33
node_js:
4+
- "11"
5+
- "10"
6+
- "9"
47
- "8"
58
- "7"
69
- "6"

‎README.md

+6-3
Original file line numberDiff line numberDiff line change
@@ -340,9 +340,12 @@ alg Parameter Value | Digital Signature or MAC Algorithm
340340
HS256 | HMAC using SHA-256 hash algorithm
341341
HS384 | HMAC using SHA-384 hash algorithm
342342
HS512 | HMAC using SHA-512 hash algorithm
343-
RS256 | RSASSA using SHA-256 hash algorithm
344-
RS384 | RSASSA using SHA-384 hash algorithm
345-
RS512 | RSASSA using SHA-512 hash algorithm
343+
RS256 | RSASSA-PKCS1-v1_5 using SHA-256 hash algorithm
344+
RS384 | RSASSA-PKCS1-v1_5 using SHA-384 hash algorithm
345+
RS512 | RSASSA-PKCS1-v1_5 using SHA-512 hash algorithm
346+
PS256 | RSASSA-PSS using SHA-256 hash algorithm (only node ^6.12.0 || >=8.0.0)
347+
PS384 | RSASSA-PSS using SHA-384 hash algorithm (only node ^6.12.0 || >=8.0.0)
348+
PS512 | RSASSA-PSS using SHA-512 hash algorithm (only node ^6.12.0 || >=8.0.0)
346349
ES256 | ECDSA using P-256 curve and SHA-256 hash algorithm
347350
ES384 | ECDSA using P-384 curve and SHA-384 hash algorithm
348351
ES512 | ECDSA using P-521 curve and SHA-512 hash algorithm

‎lib/psSupported.js

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
var semver = require('semver');
2+
3+
module.exports = semver.satisfies(process.version, '^6.12.0 || >=8.0.0');

‎package.json

+3-2
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,16 @@
3636
"url": "https://github.com/auth0/node-jsonwebtoken/issues"
3737
},
3838
"dependencies": {
39-
"jws": "^3.1.5",
39+
"jws": "^3.2.1",
4040
"lodash.includes": "^4.3.0",
4141
"lodash.isboolean": "^3.0.3",
4242
"lodash.isinteger": "^4.0.4",
4343
"lodash.isnumber": "^3.0.3",
4444
"lodash.isplainobject": "^4.0.6",
4545
"lodash.isstring": "^4.0.1",
4646
"lodash.once": "^4.0.0",
47-
"ms": "^2.1.1"
47+
"ms": "^2.1.1",
48+
"semver": "^5.6.0"
4849
},
4950
"devDependencies": {
5051
"atob": "^2.1.2",

‎sign.js

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
var timespan = require('./lib/timespan');
2+
var PS_SUPPORTED = require('./lib/psSupported');
23
var jws = require('jws');
34
var includes = require('lodash.includes');
45
var isBoolean = require('lodash.isboolean');
@@ -8,11 +9,16 @@ var isPlainObject = require('lodash.isplainobject');
89
var isString = require('lodash.isstring');
910
var once = require('lodash.once');
1011

12+
var SUPPORTED_ALGS = ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'none']
13+
if (PS_SUPPORTED) {
14+
SUPPORTED_ALGS.splice(3, 0, 'PS256', 'PS384', 'PS512');
15+
}
16+
1117
var sign_options_schema = {
1218
expiresIn: { isValid: function(value) { return isInteger(value) || (isString(value) && value); }, message: '"expiresIn" should be a number of seconds or string representing a timespan' },
1319
notBefore: { isValid: function(value) { return isInteger(value) || (isString(value) && value); }, message: '"notBefore" should be a number of seconds or string representing a timespan' },
1420
audience: { isValid: function(value) { return isString(value) || Array.isArray(value); }, message: '"audience" must be a string or array' },
15-
algorithm: { isValid: includes.bind(null, ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'none']), message: '"algorithm" must be a valid string enum value' },
21+
algorithm: { isValid: includes.bind(null, SUPPORTED_ALGS), message: '"algorithm" must be a valid string enum value' },
1622
header: { isValid: isPlainObject, message: '"header" must be an object' },
1723
encoding: { isValid: isString, message: '"encoding" must be a string' },
1824
issuer: { isValid: isString, message: '"issuer" must be a string' },

‎test/async_sign.tests.js

+11
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
var jwt = require('../index');
22
var expect = require('chai').expect;
33
var jws = require('jws');
4+
var PS_SUPPORTED = require('../lib/psSupported');
45

56
describe('signing a token asynchronously', function() {
67

@@ -58,6 +59,16 @@ describe('signing a token asynchronously', function() {
5859
});
5960
});
6061

62+
if (PS_SUPPORTED) {
63+
it('should return error when secret is not a cert for PS256', function(done) {
64+
//this throw an error because the secret is not a cert and PS256 requires a cert.
65+
jwt.sign({ foo: 'bar' }, secret, { algorithm: 'PS256' }, function (err) {
66+
expect(err).to.be.ok;
67+
done();
68+
});
69+
});
70+
}
71+
6172
it('should return error on wrong arguments', function(done) {
6273
//this throw an error because the secret is not a cert and RS256 requires a cert.
6374
jwt.sign({ foo: 'bar' }, secret, { notBefore: {} }, function (err) {

‎test/jwt.asymmetric_signing.tests.js

+10
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
var jwt = require('../index');
2+
var PS_SUPPORTED = require('../lib/psSupported');
23
var fs = require('fs');
34
var path = require('path');
45

@@ -25,6 +26,15 @@ var algorithms = {
2526
}
2627
};
2728

29+
if (PS_SUPPORTED) {
30+
algorithms.PS256 = {
31+
pub_key: loadKey('pub.pem'),
32+
priv_key: loadKey('priv.pem'),
33+
invalid_pub_key: loadKey('invalid_pub.pem')
34+
};
35+
}
36+
37+
2838
describe('Asymmetric Algorithms', function(){
2939

3040
Object.keys(algorithms).forEach(function (algorithm) {

‎test/rsa-public-key.tests.js

+14-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
var jwt = require('../');
2+
var PS_SUPPORTED = require('../lib/psSupported');
23

34
describe('public key start with BEGIN RSA PUBLIC KEY', function () {
45

5-
it('should work', function (done) {
6+
it('should work for RS family of algorithms', function (done) {
67
var fs = require('fs');
78
var cert_pub = fs.readFileSync(__dirname + '/rsa-public-key.pem');
89
var cert_priv = fs.readFileSync(__dirname + '/rsa-private.pem');
@@ -12,4 +13,16 @@ describe('public key start with BEGIN RSA PUBLIC KEY', function () {
1213
jwt.verify(token, cert_pub, done);
1314
});
1415

16+
if (PS_SUPPORTED) {
17+
it('should work for PS family of algorithms', function (done) {
18+
var fs = require('fs');
19+
var cert_pub = fs.readFileSync(__dirname + '/rsa-public-key.pem');
20+
var cert_priv = fs.readFileSync(__dirname + '/rsa-private.pem');
21+
22+
var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'PS256'});
23+
24+
jwt.verify(token, cert_pub, done);
25+
});
26+
}
27+
1528
});

‎test/schema.tests.js

+6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
var jwt = require('../index');
22
var expect = require('chai').expect;
33
var fs = require('fs');
4+
var PS_SUPPORTED = require('../lib/psSupported');
45

56
describe('schema', function() {
67

@@ -21,6 +22,11 @@ describe('schema', function() {
2122
sign({algorithm: 'RS256'});
2223
sign({algorithm: 'RS384'});
2324
sign({algorithm: 'RS512'});
25+
if (PS_SUPPORTED) {
26+
sign({algorithm: 'PS256'});
27+
sign({algorithm: 'PS384'});
28+
sign({algorithm: 'PS512'});
29+
}
2430
sign({algorithm: 'ES256'});
2531
sign({algorithm: 'ES384'});
2632
sign({algorithm: 'ES512'});

‎test/wrong_alg.tests.js

+11
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ var fs = require('fs');
22
var path = require('path');
33
var jwt = require('../index');
44
var JsonWebTokenError = require('../lib/JsonWebTokenError');
5+
var PS_SUPPORTED = require('../lib/psSupported');
56
var expect = require('chai').expect;
67

78

@@ -29,6 +30,16 @@ describe('when setting a wrong `header.alg`', function () {
2930
});
3031
});
3132

33+
if (PS_SUPPORTED) {
34+
describe('signing with pub key as HS256 and whitelisting only PS256', function () {
35+
it('should not verify', function () {
36+
expect(function () {
37+
jwt.verify(TOKEN, pub, {algorithms: ['PS256']});
38+
}).to.throw(JsonWebTokenError, /invalid algorithm/);
39+
});
40+
});
41+
}
42+
3243
describe('signing with HS256 and checking with HS384', function () {
3344
it('should not verify', function () {
3445
expect(function () {

‎verify.js

+12-5
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,18 @@ var NotBeforeError = require('./lib/NotBeforeError');
33
var TokenExpiredError = require('./lib/TokenExpiredError');
44
var decode = require('./decode');
55
var timespan = require('./lib/timespan');
6+
var PS_SUPPORTED = require('./lib/psSupported');
67
var jws = require('jws');
78

9+
var PUB_KEY_ALGS = ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'];
10+
var RSA_KEY_ALGS = ['RS256', 'RS384', 'RS512'];
11+
var HS_ALGS = ['HS256', 'HS384', 'HS512'];
12+
13+
if (PS_SUPPORTED) {
14+
PUB_KEY_ALGS.splice(3, 0, 'PS256', 'PS384', 'PS512');
15+
RSA_KEY_ALGS.splice(3, 0, 'PS256', 'PS384', 'PS512');
16+
}
17+
818
module.exports = function (jwtString, secretOrPublicKey, options, callback) {
919
if ((typeof options === 'function') && !callback) {
1020
callback = options;
@@ -102,11 +112,8 @@ module.exports = function (jwtString, secretOrPublicKey, options, callback) {
102112

103113
if (!options.algorithms) {
104114
options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') ||
105-
~secretOrPublicKey.toString().indexOf('BEGIN PUBLIC KEY') ?
106-
['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'] :
107-
~secretOrPublicKey.toString().indexOf('BEGIN RSA PUBLIC KEY') ?
108-
['RS256', 'RS384', 'RS512'] :
109-
['HS256', 'HS384', 'HS512'];
115+
~secretOrPublicKey.toString().indexOf('BEGIN PUBLIC KEY') ? PUB_KEY_ALGS :
116+
~secretOrPublicKey.toString().indexOf('BEGIN RSA PUBLIC KEY') ? RSA_KEY_ALGS : HS_ALGS;
110117

111118
}
112119

0 commit comments

Comments
 (0)