jwt 3.1.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9dd430911612a1bef370bffdf46f432a9ec2027f2091efd8d47e6d237d8c935
-  data.tar.gz: 6fa7001bc60edeb8c984cddef3bf5d9beb42656555593ad8ffc2dfe3ef4b76e8
+  metadata.gz: 3380efe421e4f603914588590fc533c17279e19e85c463b23966a3a8c8e7c663
+  data.tar.gz: 56c81c1ab9cbdd91b6b390ba01a27b4ec45d26956b8fba29e2af313de049f785
 SHA512:
-  metadata.gz: 11a6a56acb50a86223e7f60f413ac723c34997bd7ad5f2bbf2376e6c66fbfca1991a08301147062e7d5835f8fd530509b53a80876781d890d52e7fab7389fe18
-  data.tar.gz: 44f001cb3c746e4fe502a72fa9bc9234066a687145443c14cd4b09ef2bd184d119bf0d99accbfd3cd748e0eb1e8696fd90446cc3be4851ead641adbba9246b7c
+  metadata.gz: 044edf6b74d2f0c3efd3dd3280aa6aeeb8a8c6532b96b4def9745b0a1c3dca53940af68e3e5bf169aeef0be92583c279efd8f60af1156e5a7625d63d4bfade8e
+  data.tar.gz: 58beba33f077fd033cbcfb674bebae905360dd96dcd11520b5633b4be0579a4e7e8b9584c99f8dcc605481f7e67e003ca356e1b7d75368db3ae1abb0056611ac

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [v3.1.1](https://github.com/jwt/ruby-jwt/tree/v3.1.1) (2025-06-24)
+
+[Full Changelog](https://github.com/jwt/ruby-jwt/compare/v3.1.0...v3.1.1)
+
+**Fixes and enhancements:**
+
+- Require the algorithm to be provided when signing and verifying tokens using JWKs [#695](https://github.com/jwt/ruby-jwt/pull/695) ([@anakinj](https://github.com/anakinj))
+
 ## [v3.1.0](https://github.com/jwt/ruby-jwt/tree/v3.1.0) (2025-06-23)
 
 [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v3.0.0...v3.1.0)

data/README.md

@@ -268,7 +268,7 @@ token = JWT::Token.new(payload: payload, header: header)
 token.sign!(key: jwk)
 
 encoded_token = JWT::EncodedToken.new(token.jwt)
-encoded_token.verify!(signature: { key: jwk})
+encoded_token.verify!(signature: { algorithm: ["HS256", "HS512"], key: jwk})
 ```
 
 #### Using a keyfinder

data/lib/jwt/encoded_token.rb

@@ -138,7 +138,7 @@ module JWT
     # @return [nil]
     # @raise [JWT::VerificationError] if the signature verification fails.
     # @raise [ArgumentError] if neither key nor key_finder is provided, or if both are provided.
-    def verify_signature!(algorithm: nil, key: nil, key_finder: nil)
+    def verify_signature!(algorithm:, key: nil, key_finder: nil)
       return if valid_signature?(algorithm: algorithm, key: key, key_finder: key_finder)
 
       raise JWT::VerificationError, 'Signature verification failed'

data/lib/jwt/jwa.rb

@@ -15,6 +15,8 @@ module JWT
   module JWA
     # @api private
     class VerifierContext
+      attr_reader :jwa
+
       def initialize(jwa:, keys:)
         @jwa = jwa
         @keys = Array(keys)
@@ -29,6 +31,8 @@ module JWT
 
     # @api private
     class SignerContext
+      attr_reader :jwa
+
       def initialize(jwa:, key:)
         @jwa = jwa
         @key = key
@@ -37,10 +41,6 @@ module JWT
       def sign(*args, **kwargs)
         @jwa.sign(*args, **kwargs, signing_key: @key)
       end
-
-      def jwa_header
-        @jwa.header
-      end
     end
 
     class << self
@@ -64,7 +64,11 @@ module JWT
 
       # @api private
       def create_signer(algorithm:, key:)
-        return key if key.is_a?(JWK::KeyBase)
+        if key.is_a?(JWK::KeyBase)
+          validate_jwk_algorithms!(key, algorithm, DecodeError)
+
+          return key
+        end
 
         SignerContext.new(jwa: resolve(algorithm), key: key)
       end
@@ -73,10 +77,27 @@ module JWT
       def create_verifiers(algorithms:, keys:, preferred_algorithm:)
         jwks, other_keys = keys.partition { |key| key.is_a?(JWK::KeyBase) }
 
+        validate_jwk_algorithms!(jwks, algorithms, VerificationError)
+
         jwks + resolve_and_sort(algorithms: algorithms,
                                 preferred_algorithm: preferred_algorithm)
                .map { |jwa| VerifierContext.new(jwa: jwa, keys: other_keys) }
       end
+
+      # @api private
+      def validate_jwk_algorithms!(jwks, algorithms, error_class)
+        algorithms = Array(algorithms)
+
+        return if algorithms.empty?
+
+        return if Array(jwks).all? do |jwk|
+          algorithms.any? do |alg|
+            jwk.jwa.valid_alg?(alg)
+          end
+        end
+
+        raise error_class, "Provided JWKs do not support one of the specified algorithms: #{algorithms.join(', ')}"
+      end
     end
   end
 end

data/lib/jwt/jwk/key_base.rb

@@ -50,11 +50,6 @@ module JWT
         jwa.sign(**kwargs, signing_key: signing_key)
       end
 
-      # @api private
-      def jwa_header
-        jwa.header
-      end
-
       alias eql? ==
 
       def <=>(other)
@@ -63,12 +58,12 @@ module JWT
         self[:kid] <=> other[:kid]
       end
 
-      private
-
       def jwa
         raise JWT::JWKError, 'Could not resolve the JWA, the "alg" parameter is missing' unless self[:alg]
 
-        JWA.resolve(self[:alg])
+        JWA.resolve(self[:alg]).tap do |jwa|
+          raise JWT::JWKError, 'none algorithm usage not supported via JWK' if jwa.is_a?(JWA::None)
+        end
       end
 
       attr_reader :parameters

data/lib/jwt/token.rb

@@ -91,11 +91,11 @@ module JWT
     # @param algorithm [String, Object] the algorithm to use for signing.
     # @return [void]
     # @raise [JWT::EncodeError] if the token is already signed or other problems when signing
-    def sign!(key:, algorithm: nil)
+    def sign!(key:, algorithm:)
       raise ::JWT::EncodeError, 'Token already signed' if @signature
 
       JWA.create_signer(algorithm: algorithm, key: key).tap do |signer|
-        header.merge!(signer.jwa_header) { |_key, old, _new| old }
+        header.merge!(signer.jwa.header) { |_key, old, _new| old }
         @signature = signer.sign(data: signing_input)
       end
 

data/lib/jwt/version.rb

@@ -16,7 +16,7 @@ module JWT
   module VERSION
     MAJOR = 3
     MINOR = 1
-    TINY  = 0
+    TINY  = 1
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Tim Rudat
@@ -199,7 +199,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/jwt/ruby-jwt/issues
-  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v3.1.0/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v3.1.1/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: