jwt 2.2.2 → 2.4.0.beta1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (45) hide show
  1. checksums.yaml +4 -4
  2. data/.codeclimate.yml +6 -18
  3. data/.github/workflows/coverage.yml +27 -0
  4. data/.github/workflows/test.yml +66 -0
  5. data/.gitignore +2 -0
  6. data/.rspec +1 -0
  7. data/.rubocop.yml +20 -37
  8. data/.rubocop_todo.yml +22 -0
  9. data/{.ebert.yml → .sourcelevel.yml} +1 -1
  10. data/AUTHORS +79 -44
  11. data/Appraisals +7 -12
  12. data/CHANGELOG.md +143 -5
  13. data/CODE_OF_CONDUCT.md +84 -0
  14. data/Gemfile +4 -0
  15. data/README.md +135 -29
  16. data/Rakefile +6 -1
  17. data/lib/jwt/algos/ecdsa.rb +23 -5
  18. data/lib/jwt/algos/eddsa.rb +14 -4
  19. data/lib/jwt/algos/hmac.rb +2 -0
  20. data/lib/jwt/algos/none.rb +17 -0
  21. data/lib/jwt/algos/ps.rb +3 -3
  22. data/lib/jwt/algos/rsa.rb +4 -1
  23. data/lib/jwt/algos/unsupported.rb +7 -4
  24. data/lib/jwt/algos.rb +44 -0
  25. data/lib/jwt/claims_validator.rb +12 -8
  26. data/lib/jwt/decode.rb +50 -12
  27. data/lib/jwt/default_options.rb +4 -1
  28. data/lib/jwt/encode.rb +10 -9
  29. data/lib/jwt/error.rb +2 -0
  30. data/lib/jwt/jwk/ec.rb +150 -0
  31. data/lib/jwt/jwk/hmac.rb +58 -0
  32. data/lib/jwt/jwk/key_base.rb +19 -0
  33. data/lib/jwt/jwk/key_finder.rb +6 -1
  34. data/lib/jwt/jwk/rsa.rb +85 -23
  35. data/lib/jwt/jwk.rb +32 -11
  36. data/lib/jwt/security_utils.rb +2 -0
  37. data/lib/jwt/signature.rb +7 -26
  38. data/lib/jwt/verify.rb +18 -3
  39. data/lib/jwt/version.rb +3 -4
  40. data/lib/jwt/x5c_key_finder.rb +55 -0
  41. data/lib/jwt.rb +1 -1
  42. data/ruby-jwt.gemspec +9 -9
  43. metadata +20 -80
  44. data/.travis.yml +0 -29
  45. data/lib/jwt/base64.rb +0 -19
data/CHANGELOG.md CHANGED
@@ -1,5 +1,142 @@
1
1
  # Changelog
2
2
 
3
+ ## [v2.4.0](https://github.com/jwt/ruby-jwt/tree/v2.4.0) (2022-05-03)
4
+
5
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.3.0...v2.4.0)
6
+
7
+ **Implemented enhancements:**
8
+
9
+ - Ensure presence of claims [\#244](https://github.com/jwt/ruby-jwt/issues/244)
10
+ - Support verifying signature signed using x5c header [\#59](https://github.com/jwt/ruby-jwt/issues/59)
11
+ - Add x5c header key finder [\#338](https://github.com/jwt/ruby-jwt/pull/338) ([bdewater](https://github.com/bdewater))
12
+
13
+ **Security fixes:**
14
+
15
+ - Importing JWK then exporting results in different `kid` [\#313](https://github.com/jwt/ruby-jwt/issues/313)
16
+
17
+ **Closed issues:**
18
+
19
+ - Is there a way to decode a ES256 encoded JWT with a root certificate but without a public key or a private key? [\#471](https://github.com/jwt/ruby-jwt/issues/471)
20
+ - Encode output with extra quote [\#469](https://github.com/jwt/ruby-jwt/issues/469)
21
+ - Please release new gem version [\#444](https://github.com/jwt/ruby-jwt/issues/444)
22
+ - HS512 signature verification fails for valid tokens [\#438](https://github.com/jwt/ruby-jwt/issues/438)
23
+ - ArgumentError: invalid base64 while calling JWT::JWK.import\(hash\) [\#361](https://github.com/jwt/ruby-jwt/issues/361)
24
+ - NoMethodError (undefined method `encode' for JsonWebToken:Module\) [\#329](https://github.com/jwt/ruby-jwt/issues/329)
25
+
26
+ **Merged pull requests:**
27
+
28
+ - Fix RuboCop TODOs [\#476](https://github.com/jwt/ruby-jwt/pull/476) ([typhoon2099](https://github.com/typhoon2099))
29
+ - Update note about supported JWK types [\#475](https://github.com/jwt/ruby-jwt/pull/475) ([dpashkevich](https://github.com/dpashkevich))
30
+ - Make specific algorithms in README linkable [\#472](https://github.com/jwt/ruby-jwt/pull/472) ([milieu](https://github.com/milieu))
31
+ - Add tests for keyfinder logic to ensure the argument count does not matter [\#467](https://github.com/jwt/ruby-jwt/pull/467) ([anakinj](https://github.com/anakinj))
32
+ - More tests for none token [\#466](https://github.com/jwt/ruby-jwt/pull/466) ([anakinj](https://github.com/anakinj))
33
+ - Improve non algorithm tests [\#465](https://github.com/jwt/ruby-jwt/pull/465) ([anakinj](https://github.com/anakinj))
34
+ - Bring back Ruby 2.5 support and CodeClimate coverage reports [\#464](https://github.com/jwt/ruby-jwt/pull/464) ([anakinj](https://github.com/anakinj))
35
+ - Fix a little RuboCop issue [\#462](https://github.com/jwt/ruby-jwt/pull/462) ([anakinj](https://github.com/anakinj))
36
+ - Fixes with latest RuboCop [\#459](https://github.com/jwt/ruby-jwt/pull/459) ([anakinj](https://github.com/anakinj))
37
+ - Removed bundler-audit from codeclimate config [\#458](https://github.com/jwt/ruby-jwt/pull/458) ([anakinj](https://github.com/anakinj))
38
+ - Updated rubocop to 1.23.0 [\#457](https://github.com/jwt/ruby-jwt/pull/457) ([anakinj](https://github.com/anakinj))
39
+ - Add Ruby 3.1 to test matrix [\#456](https://github.com/jwt/ruby-jwt/pull/456) ([anakinj](https://github.com/anakinj))
40
+ - Use Ruby built-in url-safe base64 methods [\#454](https://github.com/jwt/ruby-jwt/pull/454) ([bdewater](https://github.com/bdewater))
41
+ - Stop running tests on EOL rubies. [\#453](https://github.com/jwt/ruby-jwt/pull/453) ([anakinj](https://github.com/anakinj))
42
+ - Fix openssl gem version check to support versons greater than 3 [\#452](https://github.com/jwt/ruby-jwt/pull/452) ([anakinj](https://github.com/anakinj))
43
+ - Readme: Typo fix re MissingRequiredClaim [\#451](https://github.com/jwt/ruby-jwt/pull/451) ([antonmorant](https://github.com/antonmorant))
44
+ - Fix for exception after mergeing \#385 [\#450](https://github.com/jwt/ruby-jwt/pull/450) ([anakinj](https://github.com/anakinj))
45
+ - Create CODE\_OF\_CONDUCT.md [\#449](https://github.com/jwt/ruby-jwt/pull/449) ([loic5](https://github.com/loic5))
46
+ - Allow regular expressions and procs to verify issuer [\#437](https://github.com/jwt/ruby-jwt/pull/437) ([rewritten](https://github.com/rewritten))
47
+ - Add Support to be able to verify from multiple keys [\#425](https://github.com/jwt/ruby-jwt/pull/425) ([ritikesh](https://github.com/ritikesh))
48
+ - Define the secp256r1 curve [\#385](https://github.com/jwt/ruby-jwt/pull/385) ([anakinj](https://github.com/anakinj))
49
+
50
+ ## [v2.3.0](https://github.com/jwt/ruby-jwt/tree/v2.3.0) (2021-10-03)
51
+
52
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.2.3...v2.3.0)
53
+
54
+ **Closed issues:**
55
+
56
+ - \[SECURITY\] Algorithm Confusion Through kid Header [\#440](https://github.com/jwt/ruby-jwt/issues/440)
57
+ - JWT to memory [\#436](https://github.com/jwt/ruby-jwt/issues/436)
58
+ - ArgumentError: wrong number of arguments \(given 2, expected 1\) [\#429](https://github.com/jwt/ruby-jwt/issues/429)
59
+ - HMAC section of README outdated [\#421](https://github.com/jwt/ruby-jwt/issues/421)
60
+ - NoMethodError: undefined method `zero?' for nil:NilClass if JWT has no 'alg' field [\#410](https://github.com/jwt/ruby-jwt/issues/410)
61
+ - Release new version [\#409](https://github.com/jwt/ruby-jwt/issues/409)
62
+ - NameError: uninitialized constant JWT::JWK [\#403](https://github.com/jwt/ruby-jwt/issues/403)
63
+
64
+ **Merged pull requests:**
65
+
66
+ - Release 2.3.0 [\#448](https://github.com/jwt/ruby-jwt/pull/448) ([excpt](https://github.com/excpt))
67
+ - Fix Style/MultilineIfModifier issues [\#447](https://github.com/jwt/ruby-jwt/pull/447) ([anakinj](https://github.com/anakinj))
68
+ - feat\(EdDSA\): Accept EdDSA as algorithm header [\#446](https://github.com/jwt/ruby-jwt/pull/446) ([Pierre-Michard](https://github.com/Pierre-Michard))
69
+ - Pass kid param through JWT::JWK.create\_from [\#445](https://github.com/jwt/ruby-jwt/pull/445) ([shaun-guth-allscripts](https://github.com/shaun-guth-allscripts))
70
+ - fix document about passing JWKs as a simple Hash [\#443](https://github.com/jwt/ruby-jwt/pull/443) ([takayamaki](https://github.com/takayamaki))
71
+ - Tests for mixing JWK keys with mismatching algorithms [\#441](https://github.com/jwt/ruby-jwt/pull/441) ([anakinj](https://github.com/anakinj))
72
+ - verify\_claims test shouldnt be within the verify\_sub test [\#431](https://github.com/jwt/ruby-jwt/pull/431) ([andyjdavis](https://github.com/andyjdavis))
73
+ - Allow decode options to specify required claims [\#430](https://github.com/jwt/ruby-jwt/pull/430) ([andyjdavis](https://github.com/andyjdavis))
74
+ - Fix OpenSSL::PKey::EC public\_key handing in tests [\#427](https://github.com/jwt/ruby-jwt/pull/427) ([anakinj](https://github.com/anakinj))
75
+ - Add documentation for find\_key [\#426](https://github.com/jwt/ruby-jwt/pull/426) ([ritikesh](https://github.com/ritikesh))
76
+ - Give ruby 3.0 as a string to avoid number formatting issues [\#424](https://github.com/jwt/ruby-jwt/pull/424) ([anakinj](https://github.com/anakinj))
77
+ - Tests for iat verification behaviour [\#423](https://github.com/jwt/ruby-jwt/pull/423) ([anakinj](https://github.com/anakinj))
78
+ - Remove HMAC with nil secret from documentation [\#422](https://github.com/jwt/ruby-jwt/pull/422) ([boardfish](https://github.com/boardfish))
79
+ - Update broken link in README [\#420](https://github.com/jwt/ruby-jwt/pull/420) ([severin](https://github.com/severin))
80
+ - Add metadata for RubyGems [\#418](https://github.com/jwt/ruby-jwt/pull/418) ([nickhammond](https://github.com/nickhammond))
81
+ - Fixed a typo about class name [\#417](https://github.com/jwt/ruby-jwt/pull/417) ([mai-f](https://github.com/mai-f))
82
+ - Fix references for v2.2.3 on CHANGELOG [\#416](https://github.com/jwt/ruby-jwt/pull/416) ([vyper](https://github.com/vyper))
83
+ - Raise IncorrectAlgorithm if token has no alg header [\#411](https://github.com/jwt/ruby-jwt/pull/411) ([bouk](https://github.com/bouk))
84
+
85
+ ## [v2.2.3](https://github.com/jwt/ruby-jwt/tree/v2.2.3) (2021-04-19)
86
+
87
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.2.2...v2.2.3)
88
+
89
+ **Implemented enhancements:**
90
+
91
+ - Verify algorithm before evaluating keyfinder [\#343](https://github.com/jwt/ruby-jwt/issues/343)
92
+ - Why jwt depends on json \< 2.0 ? [\#179](https://github.com/jwt/ruby-jwt/issues/179)
93
+ - Support for JWK in-lieu of rsa\_public [\#158](https://github.com/jwt/ruby-jwt/issues/158)
94
+ - Fix rspec `raise_error` warning [\#413](https://github.com/jwt/ruby-jwt/pull/413) ([excpt](https://github.com/excpt))
95
+ - Add support for JWKs with HMAC key type. [\#372](https://github.com/jwt/ruby-jwt/pull/372) ([phlegx](https://github.com/phlegx))
96
+ - Improve 'none' algorithm handling [\#365](https://github.com/jwt/ruby-jwt/pull/365) ([danleyden](https://github.com/danleyden))
97
+ - Handle parsed JSON JWKS input with string keys [\#348](https://github.com/jwt/ruby-jwt/pull/348) ([martinemde](https://github.com/martinemde))
98
+ - Allow Numeric values during encoding [\#327](https://github.com/jwt/ruby-jwt/pull/327) ([fanfilmu](https://github.com/fanfilmu))
99
+
100
+ **Closed issues:**
101
+
102
+ - "Signature verification raised", yet jwt.io says "Signature Verified" [\#401](https://github.com/jwt/ruby-jwt/issues/401)
103
+ - truffleruby-head build is failing [\#396](https://github.com/jwt/ruby-jwt/issues/396)
104
+ - JWT::JWK::EC needs `require 'forwardable'` [\#392](https://github.com/jwt/ruby-jwt/issues/392)
105
+ - How to use a 'signing key' as used by next-auth [\#389](https://github.com/jwt/ruby-jwt/issues/389)
106
+ - undefined method `verify' for nil:NilClass when validate a JWT with JWK [\#383](https://github.com/jwt/ruby-jwt/issues/383)
107
+ - Make specifying "algorithm" optional on decode [\#380](https://github.com/jwt/ruby-jwt/issues/380)
108
+ - ADFS created access tokens can't be validated due to missing 'kid' header [\#370](https://github.com/jwt/ruby-jwt/issues/370)
109
+ - new version? [\#355](https://github.com/jwt/ruby-jwt/issues/355)
110
+ - JWT gitlab OmniAuth provider setup support [\#354](https://github.com/jwt/ruby-jwt/issues/354)
111
+ - Release with support for RSA.import for ruby \< 2.4 hasn't been released [\#347](https://github.com/jwt/ruby-jwt/issues/347)
112
+ - cannot load such file -- jwt [\#339](https://github.com/jwt/ruby-jwt/issues/339)
113
+
114
+ **Merged pull requests:**
115
+
116
+ - Prepare 2.2.3 release [\#415](https://github.com/jwt/ruby-jwt/pull/415) ([excpt](https://github.com/excpt))
117
+ - Remove codeclimate code coverage dev dependency [\#414](https://github.com/jwt/ruby-jwt/pull/414) ([excpt](https://github.com/excpt))
118
+ - Add forwardable dependency [\#408](https://github.com/jwt/ruby-jwt/pull/408) ([anakinj](https://github.com/anakinj))
119
+ - Ignore casing of algorithm [\#405](https://github.com/jwt/ruby-jwt/pull/405) ([johnnyshields](https://github.com/johnnyshields))
120
+ - Document function and add tests for verify claims method [\#404](https://github.com/jwt/ruby-jwt/pull/404) ([yasonk](https://github.com/yasonk))
121
+ - documenting calling verify\_jti callback with 2 arguments in the readme [\#402](https://github.com/jwt/ruby-jwt/pull/402) ([HoneyryderChuck](https://github.com/HoneyryderChuck))
122
+ - Target the master branch on the build status badge [\#399](https://github.com/jwt/ruby-jwt/pull/399) ([anakinj](https://github.com/anakinj))
123
+ - Improving the local development experience [\#397](https://github.com/jwt/ruby-jwt/pull/397) ([anakinj](https://github.com/anakinj))
124
+ - Fix sourcelevel broken links [\#395](https://github.com/jwt/ruby-jwt/pull/395) ([anakinj](https://github.com/anakinj))
125
+ - Don't recommend installing gem with sudo [\#391](https://github.com/jwt/ruby-jwt/pull/391) ([tjschuck](https://github.com/tjschuck))
126
+ - Enable rubocop locally and on ci [\#390](https://github.com/jwt/ruby-jwt/pull/390) ([anakinj](https://github.com/anakinj))
127
+ - Ci and test cleanup [\#387](https://github.com/jwt/ruby-jwt/pull/387) ([anakinj](https://github.com/anakinj))
128
+ - Make JWT::JWK::EC compatible with Ruby 2.3 [\#386](https://github.com/jwt/ruby-jwt/pull/386) ([anakinj](https://github.com/anakinj))
129
+ - Support JWKs for pre 2.3 rubies [\#382](https://github.com/jwt/ruby-jwt/pull/382) ([anakinj](https://github.com/anakinj))
130
+ - Replace Travis CI with GitHub Actions \(also favor openssl/rbnacl combinations over rails compatibility tests\) [\#381](https://github.com/jwt/ruby-jwt/pull/381) ([anakinj](https://github.com/anakinj))
131
+ - Add auth0 sponsor message [\#379](https://github.com/jwt/ruby-jwt/pull/379) ([excpt](https://github.com/excpt))
132
+ - Adapt HMAC to JWK RSA code style. [\#378](https://github.com/jwt/ruby-jwt/pull/378) ([phlegx](https://github.com/phlegx))
133
+ - Disable Rails cops [\#376](https://github.com/jwt/ruby-jwt/pull/376) ([anakinj](https://github.com/anakinj))
134
+ - Support exporting RSA JWK private keys [\#375](https://github.com/jwt/ruby-jwt/pull/375) ([anakinj](https://github.com/anakinj))
135
+ - Ebert is SourceLevel nowadays [\#374](https://github.com/jwt/ruby-jwt/pull/374) ([anakinj](https://github.com/anakinj))
136
+ - Add support for JWKs with EC key type [\#371](https://github.com/jwt/ruby-jwt/pull/371) ([richardlarocque](https://github.com/richardlarocque))
137
+ - Add Truffleruby head to CI [\#368](https://github.com/jwt/ruby-jwt/pull/368) ([gogainda](https://github.com/gogainda))
138
+ - Add more docs about JWK support [\#341](https://github.com/jwt/ruby-jwt/pull/341) ([take](https://github.com/take))
139
+
3
140
  ## [v2.2.2](https://github.com/jwt/ruby-jwt/tree/v2.2.2) (2020-08-18)
4
141
 
5
142
  [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.2.1...v2.2.2)
@@ -33,7 +170,7 @@
33
170
  - Sinatra 4.90s TTFB [\#344](https://github.com/jwt/ruby-jwt/issues/344)
34
171
  - How to Logout [\#342](https://github.com/jwt/ruby-jwt/issues/342)
35
172
  - jwt token decoding even when wrong token is provided for some letters [\#337](https://github.com/jwt/ruby-jwt/issues/337)
36
- - Need to use `symbolize\_keys` everywhere! [\#330](https://github.com/jwt/ruby-jwt/issues/330)
173
+ - Need to use `symbolize_keys` everywhere! [\#330](https://github.com/jwt/ruby-jwt/issues/330)
37
174
  - eval\(\) used in Forwardable limits usage in iOS App Store [\#324](https://github.com/jwt/ruby-jwt/issues/324)
38
175
  - HS512256 OpenSSL Exception: First num too large [\#322](https://github.com/jwt/ruby-jwt/issues/322)
39
176
  - Can we change the separator character? [\#321](https://github.com/jwt/ruby-jwt/issues/321)
@@ -43,6 +180,7 @@
43
180
 
44
181
  **Merged pull requests:**
45
182
 
183
+ - Release v2.2.2 [\#367](https://github.com/jwt/ruby-jwt/pull/367) ([excpt](https://github.com/excpt))
46
184
  - Fix 'already initialized constant JWT Error' [\#357](https://github.com/jwt/ruby-jwt/pull/357) ([excpt](https://github.com/excpt))
47
185
  - Support RSA.import for all Ruby versions. [\#333](https://github.com/jwt/ruby-jwt/pull/333) ([rabajaj0509](https://github.com/rabajaj0509))
48
186
  - Removed forwardable dependency [\#325](https://github.com/jwt/ruby-jwt/pull/325) ([anakinj](https://github.com/anakinj))
@@ -140,7 +278,7 @@
140
278
  - improving code quality of jwt module [\#266](https://github.com/jwt/ruby-jwt/pull/266) ([ab320012](https://github.com/ab320012))
141
279
  - fixed ECDSA supported versions const [\#263](https://github.com/jwt/ruby-jwt/pull/263) ([starbeast](https://github.com/starbeast))
142
280
  - Added my name to contributor list [\#262](https://github.com/jwt/ruby-jwt/pull/262) ([ab320012](https://github.com/ab320012))
143
- - Use `Class\#new` Shorthand For Error Subclasses [\#255](https://github.com/jwt/ruby-jwt/pull/255) ([akabiru](https://github.com/akabiru))
281
+ - Use `Class#new` Shorthand For Error Subclasses [\#255](https://github.com/jwt/ruby-jwt/pull/255) ([akabiru](https://github.com/akabiru))
144
282
  - \[CI\] Test against Ruby 2.5 [\#253](https://github.com/jwt/ruby-jwt/pull/253) ([nicolasleger](https://github.com/nicolasleger))
145
283
  - Fix README [\#250](https://github.com/jwt/ruby-jwt/pull/250) ([rono23](https://github.com/rono23))
146
284
  - Fix link format [\#248](https://github.com/jwt/ruby-jwt/pull/248) ([y-yagi](https://github.com/y-yagi))
@@ -162,6 +300,7 @@
162
300
  **Fixed bugs:**
163
301
 
164
302
  - JWT.encode failing on encode for string [\#235](https://github.com/jwt/ruby-jwt/issues/235)
303
+ - The README says it uses an algorithm by default [\#226](https://github.com/jwt/ruby-jwt/issues/226)
165
304
  - Fix string payload issue [\#236](https://github.com/jwt/ruby-jwt/pull/236) ([excpt](https://github.com/excpt))
166
305
 
167
306
  **Security fixes:**
@@ -186,7 +325,6 @@
186
325
 
187
326
  **Fixed bugs:**
188
327
 
189
- - The README says it uses an algorithm by default [\#226](https://github.com/jwt/ruby-jwt/issues/226)
190
328
  - Support versions outside 2.1 [\#209](https://github.com/jwt/ruby-jwt/issues/209)
191
329
  - Verifying expiration without leeway throws exception [\#206](https://github.com/jwt/ruby-jwt/issues/206)
192
330
  - Ruby interpreter warning [\#200](https://github.com/jwt/ruby-jwt/issues/200)
@@ -237,7 +375,6 @@
237
375
  - The leeway parameter is applies to all time based verifications [\#129](https://github.com/jwt/ruby-jwt/issues/129)
238
376
  - Make algorithm option required to verify signature [\#184](https://github.com/jwt/ruby-jwt/pull/184) ([EmilioCristalli](https://github.com/EmilioCristalli))
239
377
  - Validate audience when payload is a scalar and options is an array [\#183](https://github.com/jwt/ruby-jwt/pull/183) ([steti](https://github.com/steti))
240
- - Fix: exp claim check [\#161](https://github.com/jwt/ruby-jwt/pull/161) ([excpt](https://github.com/excpt))
241
378
 
242
379
  **Closed issues:**
243
380
 
@@ -291,6 +428,7 @@
291
428
  - Audience Claim broken? [\#151](https://github.com/jwt/ruby-jwt/issues/151)
292
429
  - 1.5.3 breaks compatibility with 1.5.2 [\#133](https://github.com/jwt/ruby-jwt/issues/133)
293
430
  - Version 1.5.3 breaks 1.9.3 compatibility, but not documented as such [\#132](https://github.com/jwt/ruby-jwt/issues/132)
431
+ - Fix: exp claim check [\#161](https://github.com/jwt/ruby-jwt/pull/161) ([excpt](https://github.com/excpt))
294
432
 
295
433
  **Security fixes:**
296
434
 
@@ -461,7 +599,6 @@
461
599
 
462
600
  - Fix \#66 \#68 [\#69](https://github.com/jwt/ruby-jwt/pull/69) ([excpt](https://github.com/excpt))
463
601
  - When throwing errors, mention expected/received values [\#65](https://github.com/jwt/ruby-jwt/pull/65) ([rolodato](https://github.com/rolodato))
464
- - Add 'iss' support for ruby-jwt [\#61](https://github.com/jwt/ruby-jwt/pull/61) ([ZhangHanDong](https://github.com/ZhangHanDong))
465
602
 
466
603
  ## [jwt-1.4.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.4.0) (2015-03-10)
467
604
 
@@ -476,6 +613,7 @@
476
613
  - Release 1.4.0 [\#64](https://github.com/jwt/ruby-jwt/pull/64) ([excpt](https://github.com/excpt))
477
614
  - Update README.md and remove dead code [\#63](https://github.com/jwt/ruby-jwt/pull/63) ([excpt](https://github.com/excpt))
478
615
  - Add 'iat/ aud/ sub/ jti' support for ruby-jwt [\#62](https://github.com/jwt/ruby-jwt/pull/62) ([ZhangHanDong](https://github.com/ZhangHanDong))
616
+ - Add 'iss' support for ruby-jwt [\#61](https://github.com/jwt/ruby-jwt/pull/61) ([ZhangHanDong](https://github.com/ZhangHanDong))
479
617
  - Clarify .encode API in README [\#60](https://github.com/jwt/ruby-jwt/pull/60) ([jbodah](https://github.com/jbodah))
480
618
 
481
619
  ## [jwt-1.3.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.3.0) (2015-02-24)
data/CODE_OF_CONDUCT.md ADDED
@@ -0,0 +1,84 @@
1
+ # Contributor Covenant Code of Conduct
2
+
3
+ ## Our Pledge
4
+
5
+ We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
6
+
7
+ We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
8
+
9
+ ## Our Standards
10
+
11
+ Examples of behavior that contributes to a positive environment for our community include:
12
+
13
+ * Demonstrating empathy and kindness toward other people
14
+ * Being respectful of differing opinions, viewpoints, and experiences
15
+ * Giving and gracefully accepting constructive feedback
16
+ * Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
17
+ * Focusing on what is best not just for us as individuals, but for the overall community
18
+
19
+ Examples of unacceptable behavior include:
20
+
21
+ * The use of sexualized language or imagery, and sexual attention or
22
+ advances of any kind
23
+ * Trolling, insulting or derogatory comments, and personal or political attacks
24
+ * Public or private harassment
25
+ * Publishing others' private information, such as a physical or email
26
+ address, without their explicit permission
27
+ * Other conduct which could reasonably be considered inappropriate in a
28
+ professional setting
29
+
30
+ ## Enforcement Responsibilities
31
+
32
+ Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
33
+
34
+ Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
35
+
36
+ ## Scope
37
+
38
+ This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
39
+
40
+ ## Enforcement
41
+
42
+ Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at antmanj@gmail.com. All complaints will be reviewed and investigated promptly and fairly.
43
+
44
+ All community leaders are obligated to respect the privacy and security of the reporter of any incident.
45
+
46
+ ## Enforcement Guidelines
47
+
48
+ Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
49
+
50
+ ### 1. Correction
51
+
52
+ **Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
53
+
54
+ **Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
55
+
56
+ ### 2. Warning
57
+
58
+ **Community Impact**: A violation through a single incident or series of actions.
59
+
60
+ **Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
61
+
62
+ ### 3. Temporary Ban
63
+
64
+ **Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
65
+
66
+ **Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
67
+
68
+ ### 4. Permanent Ban
69
+
70
+ **Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
71
+
72
+ **Consequence**: A permanent ban from any sort of public interaction within the community.
73
+
74
+ ## Attribution
75
+
76
+ This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0,
77
+ available at https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
78
+
79
+ Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
80
+
81
+ [homepage]: https://www.contributor-covenant.org
82
+
83
+ For answers to common questions about this code of conduct, see the FAQ at
84
+ https://www.contributor-covenant.org/faq. Translations are available at https://www.contributor-covenant.org/translations.
data/Gemfile CHANGED
@@ -1,3 +1,7 @@
1
+ # frozen_string_literal: true
2
+
1
3
  source 'https://rubygems.org'
2
4
 
3
5
  gemspec
6
+
7
+ gem 'rubocop', '~> 1.23.0' # Keep .codeclimate.yml channel in sync with this one
data/README.md CHANGED
@@ -1,11 +1,11 @@
1
1
  # JWT
2
2
 
3
3
  [![Gem Version](https://badge.fury.io/rb/jwt.svg)](https://badge.fury.io/rb/jwt)
4
- [![Build Status](https://travis-ci.org/jwt/ruby-jwt.svg)](https://travis-ci.org/jwt/ruby-jwt)
4
+ [![Build Status](https://github.com/jwt/ruby-jwt/workflows/test/badge.svg?branch=master)](https://github.com/jwt/ruby-jwt/actions)
5
5
  [![Code Climate](https://codeclimate.com/github/jwt/ruby-jwt/badges/gpa.svg)](https://codeclimate.com/github/jwt/ruby-jwt)
6
6
  [![Test Coverage](https://codeclimate.com/github/jwt/ruby-jwt/badges/coverage.svg)](https://codeclimate.com/github/jwt/ruby-jwt/coverage)
7
7
  [![Issue Count](https://codeclimate.com/github/jwt/ruby-jwt/badges/issue_count.svg)](https://codeclimate.com/github/jwt/ruby-jwt)
8
- [![Ebert](https://ebertapp.io/github/jwt/ruby-jwt.svg)](https://ebertapp.io/github/jwt/ruby-jwt)
8
+ [![SourceLevel](https://app.sourcelevel.io/github/jwt/-/ruby-jwt.svg)](https://app.sourcelevel.io/github/jwt/-/ruby-jwt)
9
9
 
10
10
  A ruby implementation of the [RFC 7519 OAuth JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519) standard.
11
11
 
@@ -16,11 +16,17 @@ If you have further questions related to development or usage, join us: [ruby-jw
16
16
  * Ruby 1.9.3 support was dropped at December 31st, 2016.
17
17
  * Version 1.5.3 yanked. See: [#132](https://github.com/jwt/ruby-jwt/issues/132) and [#133](https://github.com/jwt/ruby-jwt/issues/133)
18
18
 
19
+ ## Sponsors
20
+
21
+ |Logo|Message|
22
+ |-|-|
23
+ |![auth0 logo](https://user-images.githubusercontent.com/83319/31722733-de95bbde-b3ea-11e7-96bf-4f4e8f915588.png)|If you want to quickly add secure token-based authentication to Ruby projects, feel free to check Auth0's Ruby SDK and free plan at [auth0.com/developers](https://auth0.com/developers?utm_source=GHsponsor&utm_medium=GHsponsor&utm_campaign=rubyjwt&utm_content=auth)|
24
+
19
25
  ## Installing
20
26
 
21
27
  ### Using Rubygems:
22
28
  ```bash
23
- sudo gem install jwt
29
+ gem install jwt
24
30
  ```
25
31
 
26
32
  ### Using Bundler:
@@ -32,11 +38,11 @@ And run `bundle install`
32
38
 
33
39
  ## Algorithms and Usage
34
40
 
35
- The JWT spec supports NONE, HMAC, RSASSA, ECDSA and RSASSA-PSS algorithms for cryptographic signing. Currently the jwt gem supports NONE, HMAC, RSASSA and ECDSA. If you are using cryptographic signing, you need to specify the algorithm in the options hash whenever you call JWT.decode to ensure that an attacker [cannot bypass the algorithm verification step](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/). **It is strongly recommended that you hard code the algorithm, as you may leave yourself vulnerable by dynamically picking the algorithm**
41
+ The JWT spec supports NONE, HMAC, RSASSA, ECDSA and RSASSA-PSS algorithms for cryptographic signing. Currently the jwt gem supports NONE, HMAC, RSASSA and ECDSA. If you are using cryptographic signing, you need to specify the algorithm in the options hash whenever you call JWT.decode to ensure that an attacker [cannot bypass the algorithm verification step](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/). **It is strongly recommended that you hard code the algorithm, as you may leave yourself vulnerable by dynamically picking the algorithm**
36
42
 
37
43
  See: [ JSON Web Algorithms (JWA) 3.1. "alg" (Algorithm) Header Parameter Values for JWS](https://tools.ietf.org/html/rfc7518#section-3.1)
38
44
 
39
- **NONE**
45
+ ### **NONE**
40
46
 
41
47
  * none - unsigned token
42
48
 
@@ -62,7 +68,7 @@ decoded_token = JWT.decode token, nil, false
62
68
  puts decoded_token
63
69
  ```
64
70
 
65
- **HMAC**
71
+ ### **HMAC**
66
72
 
67
73
  * HS256 - HMAC using SHA-256 hash algorithm
68
74
  * HS512256 - HMAC using SHA-512-256 hash algorithm (only available with RbNaCl; see note below)
@@ -70,6 +76,7 @@ puts decoded_token
70
76
  * HS512 - HMAC using SHA-512 hash algorithm
71
77
 
72
78
  ```ruby
79
+ # The secret must be a string. A JWT::DecodeError will be raised if it isn't provided.
73
80
  hmac_secret = 'my$ecretK3y'
74
81
 
75
82
  token = JWT.encode payload, hmac_secret, 'HS256'
@@ -79,21 +86,6 @@ puts token
79
86
 
80
87
  decoded_token = JWT.decode token, hmac_secret, true, { algorithm: 'HS256' }
81
88
 
82
- # Array
83
- # [
84
- # {"data"=>"test"}, # payload
85
- # {"alg"=>"HS256"} # header
86
- # ]
87
- puts decoded_token
88
-
89
- # Without secret key
90
- token = JWT.encode payload, nil, 'HS256'
91
-
92
- # eyJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoidGVzdCJ9.pVzcY2dX8JNM3LzIYeP2B1e1Wcpt1K3TWVvIYSF4x-o
93
- puts token
94
-
95
- decoded_token = JWT.decode token, nil, true, { algorithm: 'HS256' }
96
-
97
89
  # Array
98
90
  # [
99
91
  # {"data"=>"test"}, # payload
@@ -108,7 +100,7 @@ Note: If [RbNaCl](https://github.com/cryptosphere/rbnacl) is loadable, ruby-jwt
108
100
  [libsodium](https://github.com/jedisct1/libsodium), it can be installed
109
101
  on MacOS with `brew install libsodium`.
110
102
 
111
- **RSA**
103
+ ### **RSA**
112
104
 
113
105
  * RS256 - RSA using SHA-256 hash algorithm
114
106
  * RS384 - RSA using SHA-384 hash algorithm
@@ -133,7 +125,7 @@ decoded_token = JWT.decode token, rsa_public, true, { algorithm: 'RS256' }
133
125
  puts decoded_token
134
126
  ```
135
127
 
136
- **ECDSA**
128
+ ### **ECDSA**
137
129
 
138
130
  * ES256 - ECDSA using P-256 and SHA-256
139
131
  * ES384 - ECDSA using P-384 and SHA-384
@@ -160,7 +152,7 @@ decoded_token = JWT.decode token, ecdsa_public, true, { algorithm: 'ES256' }
160
152
  puts decoded_token
161
153
  ```
162
154
 
163
- **EDDSA**
155
+ ### **EDDSA**
164
156
 
165
157
  In order to use this algorithm you need to add the `RbNaCl` gem to you `Gemfile`.
166
158
 
@@ -189,7 +181,7 @@ decoded_token = JWT.decode token, public_key, true, { algorithm: 'ED25519' }
189
181
 
190
182
  ```
191
183
 
192
- **RSASSA-PSS**
184
+ ### **RSASSA-PSS**
193
185
 
194
186
  In order to use this algorithm you need to add the `openssl` gem to you `Gemfile` with a version greater or equal to `2.1`.
195
187
 
@@ -285,6 +277,12 @@ rescue JWT::ExpiredSignature
285
277
  end
286
278
  ```
287
279
 
280
+ The Expiration Claim verification can be disabled.
281
+ ```ruby
282
+ # Decode token without raising JWT::ExpiredSignature error
283
+ JWT.decode token, hmac_secret, true, { verify_expiration: false, algorithm: 'HS256' }
284
+ ```
285
+
288
286
  **Adding Leeway**
289
287
 
290
288
  ```ruby
@@ -325,6 +323,12 @@ rescue JWT::ImmatureSignature
325
323
  end
326
324
  ```
327
325
 
326
+ The Not Before Claim verification can be disabled.
327
+ ```ruby
328
+ # Decode token without raising JWT::ImmatureSignature error
329
+ JWT.decode token, hmac_secret, true, { verify_not_before: false, algorithm: 'HS256' }
330
+ ```
331
+
328
332
  **Adding Leeway**
329
333
 
330
334
  ```ruby
@@ -366,6 +370,36 @@ rescue JWT::InvalidIssuerError
366
370
  end
367
371
  ```
368
372
 
373
+ You can also pass a Regexp or Proc (with arity 1), verification will pass if the regexp matches or the proc returns truthy.
374
+ On supported ruby versions (>= 2.5) you can also delegate to methods, on older versions you will have
375
+ to convert them to proc (using `to_proc`)
376
+
377
+ ```ruby
378
+ JWT.decode token, hmac_secret, true,
379
+ iss: %r'https://my.awesome.website/',
380
+ verify_iss: true,
381
+ algorithm: 'HS256'
382
+ ```
383
+
384
+ ```ruby
385
+ JWT.decode token, hmac_secret, true,
386
+ iss: ->(issuer) { issuer.start_with?('My Awesome Company Inc') },
387
+ verify_iss: true,
388
+ algorithm: 'HS256'
389
+ ```
390
+
391
+ ```ruby
392
+ JWT.decode token, hmac_secret, true,
393
+ iss: method(:valid_issuer?),
394
+ verify_iss: true,
395
+ algorithm: 'HS256'
396
+
397
+ # somewhere in the same class:
398
+ def valid_issuer?(issuer)
399
+ # custom validation
400
+ end
401
+ ```
402
+
369
403
  ### Audience Claim
370
404
 
371
405
  From [Oauth JSON Web Token 4.1.3. "aud" (Audience) Claim](https://tools.ietf.org/html/rfc7519#section-4.1.3):
@@ -406,6 +440,8 @@ begin
406
440
  #decoded_token = JWT.decode token, hmac_secret, true, { verify_jti: true, algorithm: 'HS256' }
407
441
  # Alternatively, pass a proc with your own code to check if the JTI has already been used
408
442
  decoded_token = JWT.decode token, hmac_secret, true, { verify_jti: proc { |jti| my_validation_method(jti) }, algorithm: 'HS256' }
443
+ # or
444
+ decoded_token = JWT.decode token, hmac_secret, true, { verify_jti: proc { |jti, payload| my_validation_method(jti, payload) }, algorithm: 'HS256' }
409
445
  rescue JWT::InvalidJtiError
410
446
  # Handle invalid token, e.g. logout user or deny access
411
447
  puts 'Error'
@@ -454,12 +490,63 @@ rescue JWT::InvalidSubError
454
490
  end
455
491
  ```
456
492
 
493
+ ### Finding a Key
494
+
495
+ To dynamically find the key for verifying the JWT signature, pass a block to the decode block. The block receives headers and the original payload as parameters. It should return with the key to verify the signature that was used to sign the JWT.
496
+
497
+ ```ruby
498
+ issuers = %w[My_Awesome_Company1 My_Awesome_Company2]
499
+ iss_payload = { data: 'data', iss: issuers.first }
500
+
501
+ secrets = { issuers.first => hmac_secret, issuers.last => 'hmac_secret2' }
502
+
503
+ token = JWT.encode iss_payload, hmac_secret, 'HS256'
504
+
505
+ begin
506
+ # Add iss to the validation to check if the token has been manipulated
507
+ decoded_token = JWT.decode(token, nil, true, { iss: issuers, verify_iss: true, algorithm: 'HS256' }) do |_headers, payload|
508
+ secrets[payload['iss']]
509
+ end
510
+ rescue JWT::InvalidIssuerError
511
+ # Handle invalid token, e.g. logout user or deny access
512
+ end
513
+ ```
514
+
515
+ ### Required Claims
516
+
517
+ You can specify claims that must be present for decoding to be successful. JWT::MissingRequiredClaim will be raised if any are missing
518
+ ```ruby
519
+ # Will raise a JWT::MissingRequiredClaim error if the 'exp' claim is absent
520
+ JWT.decode token, hmac_secret, true, { required_claims: ['exp'], algorithm: 'HS256' }
521
+ ```
522
+
523
+ ### X.509 certificates in x5c header
524
+
525
+ A JWT signature can be verified using certificate(s) given in the `x5c` header. Before doing that, the trustworthiness of these certificate(s) must be established. This is done in accordance with RFC 5280 which (among other things) verifies the certificate(s) are issued by a trusted root certificate, the timestamps are valid, and none of the certificate(s) are revoked (i.e. being present in the root certificate's Certificate Revocation List).
526
+
527
+ ```ruby
528
+ root_certificates = [] # trusted `OpenSSL::X509::Certificate` objects
529
+ crl_uris = root_certificates.map(&:crl_uris)
530
+ crls = crl_uris.map do |uri|
531
+ # look up cached CRL by `uri` and return it if found, otherwise continue
532
+ crl = Net::HTTP.get(uri)
533
+ crl = OpenSSL::X509::CRL.new(crl)
534
+ # cache `crl` using `uri` as the key, expiry set to `crl.next_update` timestamp
535
+ end
536
+
537
+ begin
538
+ JWT.decode(token, nil, true, { x5c: { root_certificates: root_certificates, crls: crls })
539
+ rescue JWT::DecodeError
540
+ # Handle error, e.g. x5c header certificate revoked or expired
541
+ end
542
+ ```
543
+
457
544
  ### JSON Web Key (JWK)
458
545
 
459
- JWK is a JSON structure representing a cryptographic key. Currently only supports RSA public keys.
546
+ JWK is a JSON structure representing a cryptographic key. Currently only supports RSA, EC and HMAC keys.
460
547
 
461
548
  ```ruby
462
- jwk = JWT::JWK.new(OpenSSL::PKey::RSA.new(2048))
549
+ jwk = JWT::JWK.new(OpenSSL::PKey::RSA.new(2048), "optional-kid")
463
550
  payload, headers = { data: 'data' }, { kid: jwk.kid }
464
551
 
465
552
  token = JWT.encode(payload, jwk.keypair, 'RS512', headers)
@@ -479,6 +566,24 @@ rescue JWT::DecodeError
479
566
  end
480
567
  ```
481
568
 
569
+ or by passing JWK as a simple Hash
570
+
571
+ ```
572
+ jwks = { keys: [{ ... }] } # keys accepts both of string and symbol
573
+ JWT.decode(token, nil, true, { algorithms: ['RS512'], jwks: jwks})
574
+ ```
575
+
576
+ ### Importing and exporting JSON Web Keys
577
+
578
+ The ::JWT::JWK class can be used to import and export both the public key (default behaviour) and the private key. To include the private key in the export pass the `include_private` parameter to the export method.
579
+
580
+ ```ruby
581
+ jwk = JWT::JWK.new(OpenSSL::PKey::RSA.new(2048))
582
+
583
+ jwk_hash = jwk.export
584
+ jwk_hash_with_private_key = jwk.export(include_private: true)
585
+ ```
586
+
482
587
  # Development and Tests
483
588
 
484
589
  We depend on [Bundler](http://rubygems.org/gems/bundler) for defining gemspec and performing releases to rubygems.org, which can be done with
@@ -487,10 +592,11 @@ We depend on [Bundler](http://rubygems.org/gems/bundler) for defining gemspec an
487
592
  rake release
488
593
  ```
489
594
 
490
- The tests are written with rspec. Given you have installed the dependencies via bundler, you can run tests with
595
+ The tests are written with rspec. [Appraisal](https://github.com/thoughtbot/appraisal) is used to ensure compatibility with 3rd party dependencies providing cryptographic features.
491
596
 
492
597
  ```bash
493
- bundle exec rspec
598
+ bundle install
599
+ bundle exec appraisal rake test
494
600
  ```
495
601
 
496
602
  **If you want a release cut with your PR, please include a version bump according to [Semantic Versioning](http://semver.org/)**
data/Rakefile CHANGED
@@ -1,11 +1,16 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'bundler/setup'
1
4
  require 'bundler/gem_tasks'
2
5
 
3
6
  begin
4
7
  require 'rspec/core/rake_task'
8
+ require 'rubocop/rake_task'
5
9
 
6
10
  RSpec::Core::RakeTask.new(:test)
11
+ RuboCop::RakeTask.new(:rubocop)
7
12
 
8
- task default: :test
13
+ task default: %i[rubocop test]
9
14
  rescue LoadError
10
15
  puts 'RSpec rake tasks not available. Please run "bundle install" to install missing dependencies.'
11
16
  end