Bug Fix

• Add missing resty.utils module to rockspec — lib/resty/utils.lua (added in v0.3.0 for ECDH-ES Concat KDF) was not declared in the LuaRocks rockspec, causing luarocks install lua-resty-jwt to fail at runtime. (Closes #68)

Full Changelog

v0.3.1...v0.3.2

Bug Fix

• Fix ECDH-ES Concat KDF for >256-bit content encryption keys — The Concat KDF (RFC 7518 §4.6.2) only performed a single SHA-256 round (256 bits), which broke ECDH-ES direct key agreement with A192CBC-HS384 (384-bit) and A256CBC-HS512 (512-bit) content encryption. Now correctly iterates ceil(keydatalen / 256) rounds.

Testing

• 21 new JWE test cases covering previously untested algorithm combinations:
  • dir + GCM modes (A128GCM, A192GCM, A256GCM, A192CBC-HS384)
  • ECDH-ES + CBC-HS modes (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512)
  • ECDH-ES and ECDH-ES+A256KW with P-384 curve
  • Wrong key/password rejection for all key management families (dir, AES-KW, AES-GCMKW, RSA-OAEP, PBES2, ECDH-ES)
  • JWE claim validation (exp/nbf)
  • Invalid key length and unsupported algorithm rejection
• 858 tests passing (up from 795)

Coverage Tooling

• Added luacov support gated behind COVERAGE=1 env var
• New ci-coverage script for line-level coverage reports
• Current coverage: 87% overall (89% jwt.lua, 99% jwt-validators.lua, 100% utils.lua)

Full Changelog

v0.3.0...v0.3.1

Full IANA JOSE Algorithm Coverage

This release brings lua-resty-jwt to complete coverage of the IANA JSON Object Signing and Encryption algorithm registry (excluding deprecated RSA1_5 and insecure none).

New Algorithms

JWS Signing (RFC 7518 / RFC 8037)

JWE Key Management (RFC 7518)

JWE Content Encryption (RFC 7518)

Bug Fixes

• Fix non-JSON payloads rejected during JWS verification
• Fix const-correctness in FFI declaration for d2i_ECDSA_SIG
• Fix undeclared local _ in JWE functions
• Guard against nil payload in claim validation

CI / Testing

• Parallel test execution with prove -j4 (unique servroot + port per process)
• Drop repeat_each(2) — tests are deterministic, no need to double
• 795 tests passing in ~20s (down from ~100s)
• Simplified ci script, deduplicated test workflow

Documentation

• Document set_alg_whitelist and update supported algorithms list

Full Changelog

v0.2.4...v0.3.0

Security

• Authentication bypass via JWE header confusion (CVE-2024-33531)
  • Malformed JWTs with JWE-like headers could bypass signature verification
  • Parser now tags tokens by structural type (JWT vs JWE) during parsing
  • Prevents header-based routing confusion in sign and verify_jwt_obj

Bug Fixes

• RSA-OAEP-256 JWE broken on OpenSSL 3.x
  • EVP_PKEY_CTX_ctrl with EVP_PKEY_CTRL_RSA_OAEP_MD returns -1 on the 3.x compat shim
  • Uses the real EVP_PKEY_CTX_set_rsa_oaep_md function when available
  • Falls back to the ctrl path for OpenSSL 1.1.x
  • Fixes all 8 RSA-OAEP-256 JWE test failures on OpenSSL 3.x
• JWTs with missing alg header
  • Now properly rejected instead of silently passing verification

CI/CD

• Replace Travis CI with GitHub Actions
  • Test workflow on push/PR to master
  • LuaRocks + OPM publish workflow on release (gated on tests)
• Modernize test infrastructure
  • openresty-testsuite Docker image upgraded to Debian Bookworm + OpenResty 1.27.1.2 + OpenSSL 3.x
  • Multi-arch support (amd64 + arm64)
• Dependency updates
  • lua-resty-hmac submodule updated to v0.06
  • dist.ini OPM deps aligned: lua-resty-hmac >= 0.06, lua-resty-openssl >= 0.6.8

Full Changelog

v0.2.3...v0.2.4