jwt 1.5.0 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ee5f493cb3c4ed9c97a60b59f7377f410b280218
-  data.tar.gz: f86ae6f76dbdd064ff4a7a83370b1ba343981d90
+  metadata.gz: 20bef3dbabb4260b05cd6119dc1b552d630bd3e1
+  data.tar.gz: bb02d4a2bb19011a8eb531020d4780f31d44af7b
 SHA512:
-  metadata.gz: 79802a75028b87314162658551582a1c4ace40439ac718bc8ac82ed57ccaa9b5d0ac695cf4daa318bcc89616ddc8e93bf3ff79d7cb4c47903c03aee51e5bb8a1
-  data.tar.gz: c14849f306b4952c7eba478d8fbc11c0a5045f38b931b563c67fef6367d9a8e89a66b78cccd9c8e4fbc546645e221b9b70437cde4aed18ca584269a95e94e9b6
+  metadata.gz: b8a0290f1b20390efb50c613da54a37072ebceee5dc11a9cec82cf67fa9e4002f3974bb35bd503b4dd7fdaacaed47c46f6f611aa8a66200cf44fbe40eaae8a2c
+  data.tar.gz: c9bb1d911b9d3cbabe362d69c6a556c8596f1dcd2485635875d02a74e93768b56fae8c5ee683ba03c5223b8696acda8080bbe408ea580ace5052ff48dfb7cb7b

data/Rakefile

@@ -1,8 +1,9 @@
+# encoding: utf-8
 require 'rubygems'
 require 'rake'
 require 'echoe'
 
-Echoe.new('jwt', '1.5.0') do |p|
+Echoe.new('jwt', '1.5.1') do |p|
   p.description    = 'JSON Web Token implementation in Ruby'
   p.url            = 'http://github.com/progrium/ruby-jwt'
   p.author         = 'Jeff Lindsay'

data/jwt.gemspec

@@ -1,14 +1,14 @@
 # -*- encoding: utf-8 -*-
-# stub: jwt 1.5.0 ruby lib
+# stub: jwt 1.5.1 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "jwt"
-  s.version = "1.5.0"
+  s.version = "1.5.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Jeff Lindsay"]
-  s.date = "2015-05-09"
+  s.date = "2015-06-22"
   s.description = "JSON Web Token implementation in Ruby"
   s.email = "progrium@gmail.com"
   s.extra_rdoc_files = ["lib/jwt.rb", "lib/jwt/json.rb"]

data/lib/jwt.rb

@@ -1,13 +1,13 @@
-#
-# JSON Web Token implementation
-#
-# Should be up to date with the latest spec:
-# http://self-issued.info/docs/draft-jones-json-web-token-06.html
+# encoding: utf-8
 
 require 'base64'
 require 'openssl'
 require 'jwt/json'
 
+# JSON Web Token implementation
+#
+# Should be up to date with the latest spec:
+# http://self-issued.info/docs/draft-jones-json-web-token-06.html
 module JWT
   class DecodeError < StandardError; end
   class VerificationError < DecodeError; end
@@ -24,7 +24,7 @@ module JWT
   NAMED_CURVES = {
     'prime256v1' => 'ES256',
     'secp384r1' => 'ES384',
-    'secp521r1' => 'ES512',
+    'secp521r1' => 'ES512'
   }
 
   module_function
@@ -37,7 +37,7 @@ module JWT
     elsif ['ES256', 'ES384', 'ES512'].include?(algorithm)
       sign_ecdsa(algorithm, msg, key)
     else
-      raise NotImplementedError.new('Unsupported signing method')
+      fail NotImplementedError.new('Unsupported signing method')
     end
   end
 
@@ -48,11 +48,11 @@ module JWT
   def sign_ecdsa(algorithm, msg, private_key)
     key_algorithm = NAMED_CURVES[private_key.group.curve_name]
     if algorithm != key_algorithm
-      raise IncorrectAlgorithm.new("payload algorithm is #{algorithm} but #{key_algorithm} signing key was provided")
+      fail IncorrectAlgorithm.new("payload algorithm is #{algorithm} but #{key_algorithm} signing key was provided")
     end
 
     digest = OpenSSL::Digest.new(algorithm.sub('ES', 'sha'))
-    private_key.dsa_sign_asn1(digest.digest(msg))
+    asn1_to_raw(private_key.dsa_sign_asn1(digest.digest(msg)), private_key)
   end
 
   def verify_rsa(algorithm, public_key, signing_input, signature)
@@ -62,11 +62,11 @@ module JWT
   def verify_ecdsa(algorithm, public_key, signing_input, signature)
     key_algorithm = NAMED_CURVES[public_key.group.curve_name]
     if algorithm != key_algorithm
-      raise IncorrectAlgorithm.new("payload algorithm is #{algorithm} but #{key_algorithm} verification key was provided")
+      fail IncorrectAlgorithm.new("payload algorithm is #{algorithm} but #{key_algorithm} verification key was provided")
     end
 
     digest = OpenSSL::Digest.new(algorithm.sub('ES', 'sha'))
-    public_key.dsa_verify_asn1(digest.digest(signing_input), signature)
+    public_key.dsa_verify_asn1(digest.digest(signing_input), raw_to_asn1(signature, public_key))
   end
 
   def sign_hmac(algorithm, msg, key)
@@ -83,7 +83,7 @@ module JWT
   end
 
   def encoded_header(algorithm='HS256', header_fields={})
-    header = {'typ' => 'JWT', 'alg' => algorithm}.merge(header_fields)
+    header = { 'typ' => 'JWT', 'alg' => algorithm }.merge(header_fields)
     base64url_encode(encode_json(header))
   end
 
@@ -111,8 +111,8 @@ module JWT
 
   def raw_segments(jwt, verify=true)
     segments = jwt.split('.')
-    required_num_segments = verify ? [3] : [2,3]
-    raise JWT::DecodeError.new('Not enough or too many segments') unless required_num_segments.include? segments.length
+    required_num_segments = verify ? [3] : [2, 3]
+    fail JWT::DecodeError.new('Not enough or too many segments') unless required_num_segments.include? segments.length
     segments
   end
 
@@ -131,10 +131,10 @@ module JWT
   end
 
   def decode(jwt, key=nil, verify=true, options={}, &keyfinder)
-    raise JWT::DecodeError.new('Nil JSON web token') unless jwt
+    fail JWT::DecodeError.new('Nil JSON web token') unless jwt
 
     header, payload, signature, signing_input = decoded_segments(jwt, verify)
-    raise JWT::DecodeError.new('Not enough or too many segments') unless header && payload
+    fail JWT::DecodeError.new('Not enough or too many segments') unless header && payload
 
     default_options = {
       :verify_expiration => true,
@@ -152,64 +152,60 @@ module JWT
     if verify
       algo, key = signature_algorithm_and_key(header, key, &keyfinder)
       if options[:algorithm] && algo != options[:algorithm]
-        raise JWT::IncorrectAlgorithm.new('Expected a different algorithm')
+        fail JWT::IncorrectAlgorithm.new('Expected a different algorithm')
       end
       verify_signature(algo, key, signing_input, signature)
     end
 
     if options[:verify_expiration] && payload.include?('exp')
-      raise JWT::ExpiredSignature.new('Signature has expired') unless payload['exp'].to_i > (Time.now.to_i - options[:leeway])
+      fail JWT::ExpiredSignature.new('Signature has expired') unless payload['exp'].to_i > (Time.now.to_i - options[:leeway])
     end
     if options[:verify_not_before] && payload.include?('nbf')
-      raise JWT::ImmatureSignature.new('Signature nbf has not been reached') unless payload['nbf'].to_i < (Time.now.to_i + options[:leeway])
+      fail JWT::ImmatureSignature.new('Signature nbf has not been reached') unless payload['nbf'].to_i < (Time.now.to_i + options[:leeway])
     end
-    if options[:verify_iss] && payload.include?('iss')
-      raise JWT::InvalidIssuerError.new("Invalid issuer. Expected #{options['iss']}, received #{payload['iss']}") unless payload['iss'].to_s == options['iss'].to_s
+    if options[:verify_iss] && options['iss']
+      fail JWT::InvalidIssuerError.new("Invalid issuer. Expected #{options['iss']}, received #{payload['iss'] || '<none>'}") unless payload['iss'].to_s == options['iss'].to_s
     end
     if options[:verify_iat] && payload.include?('iat')
-      raise JWT::InvalidIatError.new('Invalid iat') unless (payload['iat'].is_a?(Integer) and payload['iat'].to_i <= Time.now.to_i)
+      fail JWT::InvalidIatError.new('Invalid iat') unless payload['iat'].is_a?(Integer) && payload['iat'].to_i <= Time.now.to_i
     end
-    if options[:verify_aud] && payload.include?('aud')
+    if options[:verify_aud] && options['aud']
       if payload['aud'].is_a?(Array)
-        raise JWT::InvalidAudError.new('Invalid audience') unless payload['aud'].include?(options['aud'])
+        fail JWT::InvalidAudError.new('Invalid audience') unless payload['aud'].include?(options['aud'].to_s)
       else
-        raise JWT::InvalidAudError.new("Invalid audience. Expected #{options['aud']}, received #{payload['aud']}") unless payload['aud'].to_s == options['aud'].to_s
+        fail JWT::InvalidAudError.new("Invalid audience. Expected #{options['aud']}, received #{payload['aud'] || '<none>'}") unless payload['aud'].to_s == options['aud'].to_s
       end
     end
     if options[:verify_sub] && payload.include?('sub')
-      raise JWT::InvalidSubError.new("Invalid subject. Expected #{options['sub']}, received #{payload['sub']}") unless payload['sub'].to_s == options['sub'].to_s
+      fail JWT::InvalidSubError.new("Invalid subject. Expected #{options['sub']}, received #{payload['sub']}") unless payload['sub'].to_s == options['sub'].to_s
     end
     if options[:verify_jti] && payload.include?('jti')
-      raise JWT::InvalidJtiError.new('need iat for verify jwt id') unless payload.include?('iat')
-      raise JWT::InvalidJtiError.new('Not a uniq jwt id') unless options['jti'].to_s == Digest::MD5.hexdigest("#{key}:#{payload['iat']}")
+      fail JWT::InvalidJtiError.new('need iat for verify jwt id') unless payload.include?('iat')
+      fail JWT::InvalidJtiError.new('Not a uniq jwt id') unless options['jti'].to_s == Digest::MD5.hexdigest("#{key}:#{payload['iat']}")
     end
 
-    return payload,header
+    [payload, header]
   end
 
   def signature_algorithm_and_key(header, key, &keyfinder)
-    if keyfinder
-      key = keyfinder.call(header)
-    end
+    key = keyfinder.call(header) if keyfinder
     [header['alg'], key]
   end
 
   def verify_signature(algo, key, signing_input, signature)
-    begin
-      if ['HS256', 'HS384', 'HS512'].include?(algo)
-        raise JWT::VerificationError.new('Signature verification failed') unless secure_compare(signature, sign_hmac(algo, signing_input, key))
-      elsif ['RS256', 'RS384', 'RS512'].include?(algo)
-        raise JWT::VerificationError.new('Signature verification failed') unless verify_rsa(algo, key, signing_input, signature)
-      elsif ['ES256', 'ES384', 'ES512'].include?(algo)
-        raise JWT::VerificationError.new('Signature verification failed') unless verify_ecdsa(algo, key, signing_input, signature)
-      else
-        raise JWT::VerificationError.new('Algorithm not supported')
-      end
-    rescue OpenSSL::PKey::PKeyError
-      raise JWT::VerificationError.new('Signature verification failed')
-    ensure
-      OpenSSL.errors.clear
+    if ['HS256', 'HS384', 'HS512'].include?(algo)
+      fail JWT::VerificationError.new('Signature verification failed') unless secure_compare(signature, sign_hmac(algo, signing_input, key))
+    elsif ['RS256', 'RS384', 'RS512'].include?(algo)
+      fail JWT::VerificationError.new('Signature verification failed') unless verify_rsa(algo, key, signing_input, signature)
+    elsif ['ES256', 'ES384', 'ES512'].include?(algo)
+      fail JWT::VerificationError.new('Signature verification failed') unless verify_ecdsa(algo, key, signing_input, signature)
+    else
+      fail JWT::VerificationError.new('Algorithm not supported')
     end
+  rescue OpenSSL::PKey::PKeyError
+    raise JWT::VerificationError.new('Signature verification failed')
+  ensure
+    OpenSSL.errors.clear
   end
 
   # From devise
@@ -223,4 +219,15 @@ module JWT
     res == 0
   end
 
+  def raw_to_asn1(signature, private_key)
+    byte_size = (private_key.group.degree + 7) / 8
+    r = signature[0..(byte_size - 1)]
+    s = signature[byte_size..-1]
+    OpenSSL::ASN1::Sequence.new([r, s].map { |int| OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(int, 2)) }).to_der
+  end
+
+  def asn1_to_raw(signature, public_key)
+    byte_size = (public_key.group.degree + 7) / 8
+    OpenSSL::ASN1.decode(signature).value.map { |value| value.value.to_s(2).rjust(byte_size, "\x00") }.join
+  end
 end

data/lib/jwt/json.rb

@@ -1,4 +1,6 @@
+# encoding: utf-8
 module JWT
+  # JSON fallback implementation or ruby 1.8.x
   module Json
     if RUBY_VERSION >= '1.9' && !defined?(MultiJson)
       require 'json'

data/spec/helper.rb

@@ -1,2 +1,19 @@
+# encoding: utf-8
 require 'rspec'
+require 'simplecov'
+require 'simplecov-json'
+
+SimpleCov.configure do
+  root File.join(File.dirname(__FILE__), '..')
+  project_name 'Ruby JWT - Ruby JSON Web Token implementation'
+  SimpleCov.formatter = SimpleCov::Formatter::MultiFormatter[
+    SimpleCov::Formatter::HTMLFormatter,
+    SimpleCov::Formatter::JSONFormatter
+  ]
+
+  add_filter 'spec'
+end
+
+SimpleCov.start if ENV['COVERAGE']
+
 require "#{File.dirname(__FILE__)}/../lib/jwt.rb"

data/spec/jwt_spec.rb

@@ -1,8 +1,9 @@
+# encoding: utf-8
 require 'helper'
 
 describe JWT do
   before do
-    @payload = {'foo' => 'bar', 'exp' => Time.now.to_i + 1, 'nbf' => Time.now.to_i - 1 }
+    @payload = { 'foo' => 'bar', 'exp' => Time.now.to_i + 1, 'nbf' => Time.now.to_i - 1 }
   end
 
   it 'encodes and decodes JWTs' do
@@ -51,7 +52,7 @@ describe JWT do
 
   it 'encodes and decodes JWTs with custom header fields' do
     private_key = OpenSSL::PKey::RSA.generate(512)
-    jwt = JWT.encode(@payload, private_key, 'RS256', {'kid' => 'default'})
+    jwt = JWT.encode(@payload, private_key, 'RS256', 'kid' => 'default')
     decoded_payload = JWT.decode(jwt) do |header|
       expect(header['kid']).to eq('default')
       private_key.public_key
@@ -68,40 +69,65 @@ describe JWT do
   end
 
   it 'decodes valid JWTs' do
-    example_payload = {'hello' => 'world'}
+    example_payload = { 'hello' => 'world' }
     example_secret = 'secret'
     example_jwt = 'eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJoZWxsbyI6ICJ3b3JsZCJ9.tvagLDLoaiJKxOKqpBXSEGy7SYSifZhjntgm9ctpyj8'
     decoded_payload = JWT.decode(example_jwt, example_secret)
     expect(decoded_payload).to include(example_payload)
   end
 
+  it 'decodes valid ES512 JWTs' do
+    example_payload = { 'hello' => 'world' }
+    example_jwt = 'eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJoZWxsbyI6IndvcmxkIn0.AQx1MqdTni6KuzfOoedg2-7NUiwe-b88SWbdmviz40GTwrM0Mybp1i1tVtmTSQ91oEXGXBdtwsN6yalzP9J-sp2YATX_Tv4h-BednbdSvYxZsYnUoZ--ZUdL10t7g8Yt3y9hdY_diOjIptcha6ajX8yzkDGYG42iSe3f5LywSuD6FO5c'
+    pubkey_pem = "-----BEGIN PUBLIC KEY-----\nMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAcpkss6wI7PPlxj3t7A1RqMH3nvL4\nL5Tzxze/XeeYZnHqxiX+gle70DlGRMqqOq+PJ6RYX7vK0PJFdiAIXlyPQq0B3KaU\ne86IvFeQSFrJdCc0K8NfiH2G1loIk3fiR+YLqlXk6FAeKtpXJKxR1pCQCAM+vBCs\nmZudf1zCUZ8/4eodlHU=\n-----END PUBLIC KEY-----"
+    pubkey = OpenSSL::PKey::EC.new pubkey_pem
+    decoded_payload = JWT.decode(example_jwt, pubkey)
+    expect(decoded_payload).to include(example_payload)
+  end
+
   it 'decodes valid JWTs with iss' do
-    example_payload = {'hello' => 'world', 'iss' => 'jwtiss'}
+    example_payload = { 'hello' => 'world', 'iss' => 'jwtiss' }
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaXNzIjoiand0aXNzIn0.nTZkyYfpGUyKULaj45lXw_1gXXjHvGW4h5V7okHdUqQ'
-    decoded_payload = JWT.decode(example_jwt, example_secret, true, {'iss' => 'jwtiss'})
+    decoded_payload = JWT.decode(example_jwt, example_secret, true, 'iss' => 'jwtiss')
     expect(decoded_payload).to include(example_payload)
   end
 
-  it 'raises invalid issuer' do
-    # example_payload = {'hello' => 'world', 'iss' => 'jwtiss'}
-    example_payload2 = {'hello' => 'world'}
+  context 'issuer claim verifications' do
+    it 'raises invalid issuer when "iss" claim does not match' do
+      example_secret = 'secret'
 
-    example_secret = 'secret'
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaXNzIjoiand0aXNzIn0.nTZkyYfpGUyKULaj45lXw_1gXXjHvGW4h5V7okHdUqQ'
+      expect { JWT.decode(example_jwt, example_secret, true, :verify_iss => true, 'iss' => 'jwt_iss') }.to raise_error(JWT::InvalidIssuerError, /Expected jwt_iss, received jwtiss/)
+    end
 
-    example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaXNzIjoiand0aXNzIn0.nTZkyYfpGUyKULaj45lXw_1gXXjHvGW4h5V7okHdUqQ'
-    expect{ JWT.decode(example_jwt, example_secret, true, {:verify_iss => true, 'iss' => 'jwt_iss'}) }.to raise_error(JWT::InvalidIssuerError)
+    it 'raises invalid issuer when "iss" claim is missing in payload' do
+      example_secret = 'secret'
+
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIn0.bqxXg9VwcbXKoiWtp-osd0WKPX307RjcN7EuXbdq-CE'
+      expect { JWT.decode(example_jwt, example_secret, true, :verify_iss => true, 'iss' => 'jwt_iss') }.to raise_error(JWT::InvalidIssuerError, /received <none>/)
+    end
+
+    it 'does not raise invalid issuer when verify_iss is set to false (default option)' do
+      example_secret = 'secret'
+
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaXNzIjoiand0aXNzIn0.nTZkyYfpGUyKULaj45lXw_1gXXjHvGW4h5V7okHdUqQ'
+      expect { JWT.decode(example_jwt, example_secret, true, 'iss' => 'jwt_iss') }.not_to raise_error
+    end
+
+    it 'does not raise invalid issuer when correct "iss" is in payload' do
+      example_secret = 'secret'
 
-    example_jwt2 = 'eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJoZWxsbyI6ICJ3b3JsZCJ9.tvagLDLoaiJKxOKqpBXSEGy7SYSifZhjntgm9ctpyj8'
-    decode_payload2 = JWT.decode(example_jwt2, example_secret, true, {'iss' => 'jwt_iss'})
-    expect(decode_payload2).to include(example_payload2)
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaXNzIjoiand0X2lzcyJ9.mwbyRJJZJR1C5lBt8WOLg0ZMuwP9VGDf5HiQtFhd-eA'
+      expect { JWT.decode(example_jwt, example_secret, true, :verify_iss => true, 'iss' => 'jwt_iss') }.not_to raise_error
+    end
   end
 
   it 'decodes valid JWTs with iat' do
-    example_payload = {'hello' => 'world', 'iat' => 1425917209}
+    example_payload = { 'hello' => 'world', 'iat' => 1425917209 }
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaWF0IjoxNDI1OTE3MjA5fQ.m4F-Ugo7aLnLunBBO3BeDidyWMx8T9eoJz6FW2rgQhU'
-    decoded_payload = JWT.decode(example_jwt, example_secret, true, {'iat' => true})
+    decoded_payload = JWT.decode(example_jwt, example_secret, true, 'iat' => true)
     expect(decoded_payload).to include(example_payload)
   end
 
@@ -109,14 +135,14 @@ describe JWT do
     # example_payload = {'hello' => 'world', 'iat' => 'abc'}
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaWF0IjoiMTQyNTkxNzIwOSJ9.Mn_vk61xWjIhbXFqAB0nFmNkDiCmfzUgl_LaCKRT6S8'
-    expect{ JWT.decode(example_jwt, example_secret, true, {:verify_iat => true, 'iat' => 1425917209}) }.to raise_error(JWT::InvalidIatError)
+    expect { JWT.decode(example_jwt, example_secret, true, :verify_iat => true, 'iat' => 1425917209) }.to raise_error(JWT::InvalidIatError)
   end
 
   it 'decodes valid JWTs with jti' do
-    example_payload = {'hello' => 'world', 'iat' => 1425917209, 'jti' => Digest::MD5.hexdigest('secret:1425917209')}
+    example_payload = { 'hello' => 'world', 'iat' => 1425917209, 'jti' => Digest::MD5.hexdigest('secret:1425917209') }
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaWF0IjoxNDI1OTE3MjA5LCJqdGkiOiI1NWM3NzZlMjFmN2NiZDg3OWMwNmZhYzAxOGRhYzQwMiJ9.ET0hb-VTUOL3M22oG13ofzvGPLMAncbF8rdNDIqo8tg'
-    decoded_payload = JWT.decode(example_jwt, example_secret, true, {'jti' => Digest::MD5.hexdigest('secret:1425917209')})
+    decoded_payload = JWT.decode(example_jwt, example_secret, true, 'jti' => Digest::MD5.hexdigest('secret:1425917209'))
     expect(decoded_payload).to include(example_payload)
   end
 
@@ -124,7 +150,7 @@ describe JWT do
     # example_payload = {'hello' => 'world', 'iat' => 1425917209, 'jti' => Digest::MD5.hexdigest('secret:1425917209')}
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiaWF0IjoxNDI1OTE3MjA5LCJqdGkiOiI1NWM3NzZlMjFmN2NiZDg3OWMwNmZhYzAxOGRhYzQwMiJ9.ET0hb-VTUOL3M22oG13ofzvGPLMAncbF8rdNDIqo8tg'
-    expect{ JWT.decode(example_jwt, example_secret, true, {:verify_jti => true, 'jti' => Digest::MD5.hexdigest('secret:1425922032')}) }.to raise_error(JWT::InvalidJtiError)
+    expect { JWT.decode(example_jwt, example_secret, true, :verify_jti => true, 'jti' => Digest::MD5.hexdigest('secret:1425922032')) }.to raise_error(JWT::InvalidJtiError)
     # expect{ JWT.decode(example_jwt, example_secret) }.to raise_error(JWT::InvalidJtiError)
   end
 
@@ -132,43 +158,46 @@ describe JWT do
     # example_payload = {'hello' => 'world', 'jti' => Digest::MD5.hexdigest('secret:1425917209')}
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwianRpIjoiNTVjNzc2ZTIxZjdjYmQ4NzljMDZmYWMwMThkYWM0MDIifQ.n0foJCnCM_-_xUvG_TOmR9mYpL2y0UqZOD_gv33djeE'
-    expect{ JWT.decode(example_jwt, example_secret, true, {:verify_jti => true, 'jti' => Digest::MD5.hexdigest('secret:1425922032')}) }.to raise_error(JWT::InvalidJtiError)
-  end
+    expect { JWT.decode(example_jwt, example_secret, true, :verify_jti => true, 'jti' => Digest::MD5.hexdigest('secret:1425922032')) }.to raise_error(JWT::InvalidJtiError)
+  end
+
+  context 'aud claim verifications' do
+    it 'decodes valid JWTs with aud' do
+      example_payload = { 'hello' => 'world', 'aud' => 'url:pnd' }
+      example_payload2 = { 'hello' => 'world', 'aud' => ['url:pnd', 'aud:yes'] }
+      example_secret = 'secret'
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiYXVkIjoidXJsOnBuZCJ9._gT5veUtNiZD7wLEC6Gd0-nkQV3cl1z8G0zXq8qcd-8'
+      example_jwt2 = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiYXVkIjpbInVybDpwbmQiLCJhdWQ6eWVzIl19.qNPNcT4X9B5uI91rIwbW2bIPTsp8wbRYW3jkZkrmqbQ'
+      decoded_payload = JWT.decode(example_jwt, example_secret, true, :verify_aud => true, 'aud' => 'url:pnd')
+      decoded_payload2 = JWT.decode(example_jwt2, example_secret, true, :verify_aud => true, 'aud' => 'url:pnd')
+      expect(decoded_payload).to include(example_payload)
+      expect(decoded_payload2).to include(example_payload2)
+    end
 
-  it 'decodes valid JWTs with aud' do
-    example_payload = {'hello' => 'world', 'aud' => 'url:pnd'}
-    example_payload2 = {'hello' => 'world', 'aud' => ['url:pnd', 'aud:yes']}
-    example_secret = 'secret'
-    example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiYXVkIjoidXJsOnBuZCJ9._gT5veUtNiZD7wLEC6Gd0-nkQV3cl1z8G0zXq8qcd-8'
-    example_jwt2 = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiYXVkIjpbInVybDpwbmQiLCJhdWQ6eWVzIl19.qNPNcT4X9B5uI91rIwbW2bIPTsp8wbRYW3jkZkrmqbQ'
-    decoded_payload = JWT.decode(example_jwt, example_secret, true, {'aud' => 'url:pnd'})
-    decoded_payload2 = JWT.decode(example_jwt2, example_secret, true, {'aud' => 'url:pnd'})
-    expect(decoded_payload).to include(example_payload)
-    expect(decoded_payload2).to include(example_payload2)
-  end
+    it 'raises deode exception when aud is invalid' do
+      # example_payload = {'hello' => 'world', 'aud' => 'url:pnd'}
+      example_secret = 'secret'
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiYXVkIjoidXJsOnBuZCJ9._gT5veUtNiZD7wLEC6Gd0-nkQV3cl1z8G0zXq8qcd-8'
+      expect { JWT.decode(example_jwt, example_secret, true, :verify_aud => true, 'aud' => 'wrong:aud') }.to raise_error(JWT::InvalidAudError)
+    end
 
-  it 'raises deode exception when aud is invalid' do
-    # example_payload = {'hello' => 'world', 'aud' => 'url:pnd'}
-    example_secret = 'secret'
-    example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwiYXVkIjoidXJsOnBuZCJ9._gT5veUtNiZD7wLEC6Gd0-nkQV3cl1z8G0zXq8qcd-8'
-    expect{ JWT.decode(example_jwt, example_secret, true, {:verify_aud => true, 'aud' => 'wrong:aud'}) }.to raise_error(JWT::InvalidAudError)
+    it 'raises deode exception when aud is missing' do
+      # JWT.encode('hello' => 'world', 'secret')
+      example_secret = 'secret'
+      example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIn0.bqxXg9VwcbXKoiWtp-osd0WKPX307RjcN7EuXbdq-CE'
+      expect { JWT.decode(example_jwt, example_secret, true, :verify_aud => true, 'aud' => 'url:pnd') }.to raise_error(JWT::InvalidAudError)
+    end
   end
 
   it 'decodes valid JWTs with sub' do
-    example_payload = {'hello' => 'world', 'sub' => 'subject'}
+    example_payload = { 'hello' => 'world', 'sub' => 'subject' }
     example_secret = 'secret'
     example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwic3ViIjoic3ViamVjdCJ9.QUnNVZm4SPB4vP2zY9m1LoUSOx-5oGXBhj7R89D_UtA'
-    decoded_payload = JWT.decode(example_jwt, example_secret, true, {'sub' => 'subject'})
+    decoded_payload = JWT.decode(example_jwt, example_secret, true, 'sub' => 'subject')
     expect(decoded_payload).to include(example_payload)
   end
 
-  it 'raise decode exception when the sub is invalid' do
-    # example_payload = {'hello' => 'world', 'sub' => 'subject'}
-    # TODO: Test not working
-    example_secret = 'secret'
-    example_jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJoZWxsbyI6IndvcmxkIiwic3ViIjoic3ViamVjdCJ9.QUnNVZm4SPB4vP2zY9m1LoUSOx-5oGXBhj7R89D_UtA'
-    # expect{ JWT.decode(example_jwt, example_secret, true, {:verify_iss => true, 'iss' => 'subject'}) }.to raise_error(JWT::InvalidSubError)
-  end
+  it 'raise decode exception when the sub is invalid'
 
   it 'raises decode exception when the token is invalid' do
     example_secret = 'secret'
@@ -312,7 +341,7 @@ describe JWT do
     expired_payload['exp'] = Time.now.to_i - 1
     secret = 'secret'
     jwt = JWT.encode(expired_payload, secret)
-    decoded_payload = JWT.decode(jwt, secret, true, {:verify_expiration => false})
+    decoded_payload = JWT.decode(jwt, secret, true, :verify_expiration => false)
     expect(decoded_payload).to include(expired_payload)
   end
 
@@ -321,7 +350,7 @@ describe JWT do
     expired_payload['exp'] = Time.now.to_i - 2
     secret = 'secret'
     jwt = JWT.encode(expired_payload, secret)
-    decoded_payload = JWT.decode(jwt, secret, true, {:leeway => 3})
+    decoded_payload = JWT.decode(jwt, secret, true, :leeway => 3)
     expect(decoded_payload).to include(expired_payload)
   end
 
@@ -337,7 +366,7 @@ describe JWT do
     mature_payload = @payload.clone
     secret = 'secret'
     jwt = JWT.encode(mature_payload, secret)
-    decoded_payload = JWT.decode(jwt, secret, true, {:verify_expiration => false})
+    decoded_payload = JWT.decode(jwt, secret, true, :verify_expiration => false)
     expect(decoded_payload).to include(mature_payload)
   end
 
@@ -354,7 +383,7 @@ describe JWT do
     immature_payload['nbf'] = Time.now.to_i + 2
     secret = 'secret'
     jwt = JWT.encode(immature_payload, secret)
-    decoded_payload = JWT.decode(jwt, secret, true, {:verify_not_before => false})
+    decoded_payload = JWT.decode(jwt, secret, true, :verify_not_before => false)
     expect(decoded_payload).to include(immature_payload)
   end
 
@@ -363,7 +392,7 @@ describe JWT do
     immature_payload['nbf'] = Time.now.to_i - 2
     secret = 'secret'
     jwt = JWT.encode(immature_payload, secret)
-    decoded_payload = JWT.decode(jwt, secret, true, {:leeway => 3})
+    decoded_payload = JWT.decode(jwt, secret, true, :leeway => 3)
     expect(decoded_payload).to include(immature_payload)
   end
 
@@ -402,13 +431,13 @@ xwIDAQAB
 -----END PUBLIC KEY-----
 PUBKEY
     jwt = (
-      'eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwiY' +
-      'XVkIjoiMTA2MDM1Nzg5MTY4OC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSI' +
-      'sImNpZCI6IjEwNjAzNTc4OTE2ODguYXBwcy5nb29nbGV1c2VyY29udGVudC5jb' +
-      '20iLCJpZCI6IjExNjQ1MjgyNDMwOTg1Njc4MjE2MyIsInRva2VuX2hhc2giOiJ' +
-      '0Z2hEOUo4bjhWME4ydmN3NmVNaWpnIiwiaWF0IjoxMzIwNjcwOTc4LCJleHAiO' +
-      'jEzMjA2NzQ4Nzh9.D8x_wirkxDElqKdJBcsIws3Ogesk38okz6MN7zqC7nEAA7' +
-      'wcy1PxsROY1fmBvXSer0IQesAqOW-rPOCNReSn-eY8d53ph1x2HAF-AzEi3GOl' +
+      'eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwiY' \
+      'XVkIjoiMTA2MDM1Nzg5MTY4OC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSI' \
+      'sImNpZCI6IjEwNjAzNTc4OTE2ODguYXBwcy5nb29nbGV1c2VyY29udGVudC5jb' \
+      '20iLCJpZCI6IjExNjQ1MjgyNDMwOTg1Njc4MjE2MyIsInRva2VuX2hhc2giOiJ' \
+      '0Z2hEOUo4bjhWME4ydmN3NmVNaWpnIiwiaWF0IjoxMzIwNjcwOTc4LCJleHAiO' \
+      'jEzMjA2NzQ4Nzh9.D8x_wirkxDElqKdJBcsIws3Ogesk38okz6MN7zqC7nEAA7' \
+      'wcy1PxsROY1fmBvXSer0IQesAqOW-rPOCNReSn-eY8d53ph1x2HAF-AzEi3GOl' \
       '6hFycH8wj7Su6JqqyEbIVLxE7q7DkAZGaMPkxbTHs1EhSd5_oaKQ6O4xO3ZnnT4'
     )
     expect { JWT.decode(jwt, pubkey, true) }.to raise_error(JWT::DecodeError)
@@ -427,7 +456,7 @@ PUBKEY
       jwt = JWT.encode(@payload, secret)
       decoded_segments = JWT.decoded_segments(jwt)
       expect(decoded_segments.size).to eq(4)
-      expect(decoded_segments[0]).to eq({'typ' => 'JWT', 'alg' => 'HS256'})
+      expect(decoded_segments[0]).to eq('typ' => 'JWT', 'alg' => 'HS256')
       expect(decoded_segments[1]).to eq(@payload)
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.1
 platform: ruby
 authors:
 - Jeff Lindsay
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-05-09 00:00:00.000000000 Z
+date: 2015-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: echoe