jwt 3.1.0 → 3.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9dd430911612a1bef370bffdf46f432a9ec2027f2091efd8d47e6d237d8c935
-  data.tar.gz: 6fa7001bc60edeb8c984cddef3bf5d9beb42656555593ad8ffc2dfe3ef4b76e8
+  metadata.gz: 4fbf6e518cee3ac505360ea356f34fab6a68c5dfc2112671105085fbb03c08df
+  data.tar.gz: 0f206bdf51b4a979b6f734d6582f7e18762f2d3a1ee7feb38499fc4a92d77115
 SHA512:
-  metadata.gz: 11a6a56acb50a86223e7f60f413ac723c34997bd7ad5f2bbf2376e6c66fbfca1991a08301147062e7d5835f8fd530509b53a80876781d890d52e7fab7389fe18
-  data.tar.gz: 44f001cb3c746e4fe502a72fa9bc9234066a687145443c14cd4b09ef2bd184d119bf0d99accbfd3cd748e0eb1e8696fd90446cc3be4851ead641adbba9246b7c
+  metadata.gz: 4fa9df3dae62f1abbe065fd144641a8869faddd45be94cb58871dc690fead80f38f741b5de5319b5a31d8d28fe16ae32627f27d396cbe2f91f80acc9a6d3e477
+  data.tar.gz: 41e30090c5ee55b3706b4d2bddd73dc596e4db46669c292af56bca9ebe9f36a8eafe7ce33578f3012d87f910a6880ee26e6c26c46bfda59470a23f24e47a739d

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [v3.1.2](https://github.com/jwt/ruby-jwt/tree/v3.1.2) (2025-06-28)
+
+[Full Changelog](https://github.com/jwt/ruby-jwt/compare/v3.1.1...v3.1.2)
+
+**Fixes and enhancements:**
+
+- Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa [#697](https://github.com/jwt/ruby-jwt/pull/697)
+- Fix signing with a EC JWK [#699](https://github.com/jwt/ruby-jwt/pull/699) ([@anakinj](https://github.com/anakinj))
+
+## [v3.1.1](https://github.com/jwt/ruby-jwt/tree/v3.1.1) (2025-06-24)
+
+[Full Changelog](https://github.com/jwt/ruby-jwt/compare/v3.1.0...v3.1.1)
+
+**Fixes and enhancements:**
+
+- Require the algorithm to be provided when signing and verifying tokens using JWKs [#695](https://github.com/jwt/ruby-jwt/pull/695) ([@anakinj](https://github.com/anakinj))
+
 ## [v3.1.0](https://github.com/jwt/ruby-jwt/tree/v3.1.0) (2025-06-23)
 
 [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v3.0.0...v3.1.0)

data/README.md

@@ -265,10 +265,10 @@ jwk = JWT::JWK.import(JSON.parse(jwk_json))
 
 token = JWT::Token.new(payload: payload, header: header)
 
-token.sign!(key: jwk)
+token.sign!(key: jwk, algorithm: 'HS256')
 
 encoded_token = JWT::EncodedToken.new(token.jwt)
-encoded_token.verify!(signature: { key: jwk})
+encoded_token.verify!(signature: { algorithm: ["HS256", "HS512"], key: jwk})
 ```
 
 #### Using a keyfinder

data/lib/jwt/encoded_token.rb

@@ -138,7 +138,7 @@ module JWT
     # @return [nil]
     # @raise [JWT::VerificationError] if the signature verification fails.
     # @raise [ArgumentError] if neither key nor key_finder is provided, or if both are provided.
-    def verify_signature!(algorithm: nil, key: nil, key_finder: nil)
+    def verify_signature!(algorithm:, key: nil, key_finder: nil)
       return if valid_signature?(algorithm: algorithm, key: key, key_finder: key_finder)
 
       raise JWT::VerificationError, 'Signature verification failed'

data/lib/jwt/jwa/ecdsa.rb

@@ -8,7 +8,7 @@ module JWT
 
       def initialize(alg, digest)
         @alg = alg
-        @digest = OpenSSL::Digest.new(digest)
+        @digest = digest
       end
 
       def sign(data:, signing_key:)
@@ -20,7 +20,7 @@ module JWT
 
         raise IncorrectAlgorithm, "payload algorithm is #{alg} but #{key_algorithm} signing key was provided" if alg != key_algorithm
 
-        asn1_to_raw(signing_key.dsa_sign_asn1(digest.digest(data)), signing_key)
+        asn1_to_raw(signing_key.dsa_sign_asn1(OpenSSL::Digest.new(digest).digest(data)), signing_key)
       end
 
       def verify(data:, signature:, verification_key:)
@@ -32,7 +32,7 @@ module JWT
         key_algorithm = curve_definition[:algorithm]
         raise IncorrectAlgorithm, "payload algorithm is #{alg} but #{key_algorithm} verification key was provided" if alg != key_algorithm
 
-        verification_key.dsa_verify_asn1(digest.digest(data), raw_to_asn1(signature, verification_key))
+        verification_key.dsa_verify_asn1(OpenSSL::Digest.new(digest).digest(data), raw_to_asn1(signature, verification_key))
       rescue OpenSSL::PKey::PKeyError
         raise JWT::VerificationError, 'Signature verification raised'
       end

data/lib/jwt/jwa/rsa.rb

@@ -8,18 +8,18 @@ module JWT
 
       def initialize(alg)
         @alg = alg
-        @digest = OpenSSL::Digest.new(alg.sub('RS', 'SHA'))
+        @digest = alg.sub('RS', 'SHA')
       end
 
       def sign(data:, signing_key:)
         raise_sign_error!("The given key is a #{signing_key.class}. It has to be an OpenSSL::PKey::RSA instance") unless signing_key.is_a?(OpenSSL::PKey::RSA)
         raise_sign_error!('The key length must be greater than or equal to 2048 bits') if signing_key.n.num_bits < 2048
 
-        signing_key.sign(digest, data)
+        signing_key.sign(OpenSSL::Digest.new(digest), data)
       end
 
       def verify(data:, signature:, verification_key:)
-        verification_key.verify(digest, signature, data)
+        verification_key.verify(OpenSSL::Digest.new(digest), signature, data)
       rescue OpenSSL::PKey::PKeyError
         raise JWT::VerificationError, 'Signature verification raised'
       end

data/lib/jwt/jwa.rb

@@ -15,6 +15,8 @@ module JWT
   module JWA
     # @api private
     class VerifierContext
+      attr_reader :jwa
+
       def initialize(jwa:, keys:)
         @jwa = jwa
         @keys = Array(keys)
@@ -29,6 +31,8 @@ module JWT
 
     # @api private
     class SignerContext
+      attr_reader :jwa
+
       def initialize(jwa:, key:)
         @jwa = jwa
         @key = key
@@ -37,10 +41,6 @@ module JWT
       def sign(*args, **kwargs)
         @jwa.sign(*args, **kwargs, signing_key: @key)
       end
-
-      def jwa_header
-        @jwa.header
-      end
     end
 
     class << self
@@ -64,7 +64,11 @@ module JWT
 
       # @api private
       def create_signer(algorithm:, key:)
-        return key if key.is_a?(JWK::KeyBase)
+        if key.is_a?(JWK::KeyBase)
+          validate_jwk_algorithms!(key, algorithm, DecodeError)
+
+          return key
+        end
 
         SignerContext.new(jwa: resolve(algorithm), key: key)
       end
@@ -73,10 +77,27 @@ module JWT
       def create_verifiers(algorithms:, keys:, preferred_algorithm:)
         jwks, other_keys = keys.partition { |key| key.is_a?(JWK::KeyBase) }
 
+        validate_jwk_algorithms!(jwks, algorithms, VerificationError)
+
         jwks + resolve_and_sort(algorithms: algorithms,
                                 preferred_algorithm: preferred_algorithm)
                .map { |jwa| VerifierContext.new(jwa: jwa, keys: other_keys) }
       end
+
+      # @api private
+      def validate_jwk_algorithms!(jwks, algorithms, error_class)
+        algorithms = Array(algorithms)
+
+        return if algorithms.empty?
+
+        return if Array(jwks).all? do |jwk|
+          algorithms.any? do |alg|
+            jwk.jwa.valid_alg?(alg)
+          end
+        end
+
+        raise error_class, "Provided JWKs do not support one of the specified algorithms: #{algorithms.join(', ')}"
+      end
     end
   end
 end

data/lib/jwt/jwk/ec.rb

@@ -71,8 +71,6 @@ module JWT
         super
       end
 
-      private
-
       def jwa
         return super if self[:alg]
 
@@ -80,6 +78,8 @@ module JWT
         JWA.resolve(JWA::Ecdsa.curve_by_name(curve_name)[:algorithm])
       end
 
+      private
+
       def ec_key
         @ec_key ||= create_ec_key(self[:crv], self[:x], self[:y], self[:d])
       end

data/lib/jwt/jwk/key_base.rb

@@ -50,11 +50,6 @@ module JWT
         jwa.sign(**kwargs, signing_key: signing_key)
       end
 
-      # @api private
-      def jwa_header
-        jwa.header
-      end
-
       alias eql? ==
 
       def <=>(other)
@@ -63,12 +58,12 @@ module JWT
         self[:kid] <=> other[:kid]
       end
 
-      private
-
       def jwa
         raise JWT::JWKError, 'Could not resolve the JWA, the "alg" parameter is missing' unless self[:alg]
 
-        JWA.resolve(self[:alg])
+        JWA.resolve(self[:alg]).tap do |jwa|
+          raise JWT::JWKError, 'none algorithm usage not supported via JWK' if jwa.is_a?(JWA::None)
+        end
       end
 
       attr_reader :parameters

data/lib/jwt/token.rb

@@ -91,11 +91,11 @@ module JWT
     # @param algorithm [String, Object] the algorithm to use for signing.
     # @return [void]
     # @raise [JWT::EncodeError] if the token is already signed or other problems when signing
-    def sign!(key:, algorithm: nil)
+    def sign!(key:, algorithm:)
       raise ::JWT::EncodeError, 'Token already signed' if @signature
 
       JWA.create_signer(algorithm: algorithm, key: key).tap do |signer|
-        header.merge!(signer.jwa_header) { |_key, old, _new| old }
+        header.merge!(signer.jwa.header) { |_key, old, _new| old }
         @signature = signer.sign(data: signing_input)
       end
 

data/lib/jwt/version.rb

@@ -16,7 +16,7 @@ module JWT
   module VERSION
     MAJOR = 3
     MINOR = 1
-    TINY  = 0
+    TINY  = 2
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.2
 platform: ruby
 authors:
 - Tim Rudat
@@ -199,7 +199,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/jwt/ruby-jwt/issues
-  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v3.1.0/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v3.1.2/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: