jwt 1.5.4 → 1.5.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. checksums.yaml +5 -13
  2. data/.gitignore +5 -0
  3. data/.rspec +0 -1
  4. data/CHANGELOG.md +352 -0
  5. data/README.md +5 -5
  6. data/Rakefile +10 -0
  7. data/lib/jwt.rb +37 -14
  8. data/lib/jwt/error.rb +1 -0
  9. data/lib/jwt/verify.rb +25 -15
  10. data/lib/jwt/version.rb +2 -2
  11. data/ruby-jwt.gemspec +1 -0
  12. data/spec/integration/readme_examples_spec.rb +190 -0
  13. data/spec/jwt/verify_spec.rb +12 -3
  14. data/spec/jwt_spec.rb +8 -0
  15. metadata +39 -22
checksums.yaml CHANGED
@@ -1,15 +1,7 @@
1
1
  ---
2
- !binary "U0hBMQ==":
3
- metadata.gz: !binary |-
4
- NDM3ZjQ5OWVjMGQ3NDYxZWRmZjAxNTQzZmU5YjlhODg4YzcwY2QzMg==
5
- data.tar.gz: !binary |-
6
- YmM3YWU5NTkxNDEzOGQyMTAzMTIyYzVmNWNhY2ZlMWU2NTFlZjliNQ==
2
+ SHA1:
3
+ metadata.gz: 0ab60d996890a0c93b46c4c86170e03fbfdca0c2
4
+ data.tar.gz: 83765101b7357c3c548bad68baeff603b83ce446
7
5
  SHA512:
8
- metadata.gz: !binary |-
9
- NzA3NWQ4ZjQ4OWEyNTY5ZjE5NGYzMjBhZDkzMmZhOTdmNzcwMmMxNWI5MmYz
10
- N2E3MmE5NmQ1ZjlhZTU2ZDc3NDYxYzIxZjhkMjJjOGE1NDI5MDI4MmVmN2Fi
11
- ZGExYWMzOGI3ZDAxNWE2NzdhOWRjNjkzZjAxMjRmMGM0NTIwZDU=
12
- data.tar.gz: !binary |-
13
- OGQxM2IyM2E1ZTUzM2QzZjBlMmZiYzBiMGU4OGM5YjI5NTU0YjA2ZWQ3MDY3
14
- MjQ0ZDMxNTEzMWE0NzUzYjAxOGQ2MTAwZTFiMmU5YmYzZDFjYTVhNTdhOGVm
15
- N2Q3Mjk0ODMxYWI3NDg3M2IwYzA5MmMwYTgzNzhjM2U5YTJkODI=
6
+ metadata.gz: bab32a2372d9a05d4f5b8591c77cb9be60c252b796b778c417a5ad9a2f87a7faae3421029b07543c06f3f7bdf5ad2c786776f6f45a93dca7e128f6753ce143dd
7
+ data.tar.gz: 1dd7005d75ff1a20cfc95e9362a48776bcc498f26ba4362f027252e32d32dcd30f8a50045fbb85da5486d231c63aaa043b20101169ee1fecf702dee2e95483c8
data/.gitignore CHANGED
@@ -4,3 +4,8 @@ pkg
4
4
  Gemfile.lock
5
5
  coverage/
6
6
  .DS_Store
7
+ .rbenv-gemsets
8
+ .ruby-version
9
+ .vscode/
10
+ .bundle
11
+ bin/
data/.rspec CHANGED
@@ -1,2 +1 @@
1
1
  --color
2
- --format d
data/CHANGELOG.md ADDED
@@ -0,0 +1,352 @@
1
+ # Change Log
2
+
3
+ ## [v1.5.5](https://github.com/jwt/ruby-jwt/tree/v1.5.5) (2016-09-16)
4
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.4...v1.5.5)
5
+
6
+ **Implemented enhancements:**
7
+
8
+ - JWT.decode always raises JWT::ExpiredSignature for tokens created with Time objects passed as the `exp` parameter [\#148](https://github.com/jwt/ruby-jwt/issues/148)
9
+
10
+ **Fixed bugs:**
11
+
12
+ - expiration check does not give "Signature has expired" error for the exact time of expiration [\#157](https://github.com/jwt/ruby-jwt/issues/157)
13
+ - JTI claim broken? [\#152](https://github.com/jwt/ruby-jwt/issues/152)
14
+ - Audience Claim broken? [\#151](https://github.com/jwt/ruby-jwt/issues/151)
15
+ - 1.5.3 breaks compatibility with 1.5.2 [\#133](https://github.com/jwt/ruby-jwt/issues/133)
16
+ - Version 1.5.3 breaks 1.9.3 compatibility, but not documented as such [\#132](https://github.com/jwt/ruby-jwt/issues/132)
17
+ - Fix: exp claim check [\#161](https://github.com/jwt/ruby-jwt/pull/161) ([excpt](https://github.com/excpt))
18
+
19
+ **Closed issues:**
20
+
21
+ - Rendering Json Results in JWT::DecodeError [\#162](https://github.com/jwt/ruby-jwt/issues/162)
22
+ - PHP Libraries [\#154](https://github.com/jwt/ruby-jwt/issues/154)
23
+ - \[security\] Signature verified after expiration/sub/iss checks [\#153](https://github.com/jwt/ruby-jwt/issues/153)
24
+ - Is ruby-jwt thread-safe? [\#150](https://github.com/jwt/ruby-jwt/issues/150)
25
+ - JWT 1.5.3 [\#143](https://github.com/jwt/ruby-jwt/issues/143)
26
+ - gem install v 1.5.3 returns error [\#141](https://github.com/jwt/ruby-jwt/issues/141)
27
+ - Adding a CHANGELOG [\#140](https://github.com/jwt/ruby-jwt/issues/140)
28
+
29
+ **Merged pull requests:**
30
+
31
+ - Bump version [\#165](https://github.com/jwt/ruby-jwt/pull/165) ([excpt](https://github.com/excpt))
32
+ - Improve error message for exp claim in payload [\#164](https://github.com/jwt/ruby-jwt/pull/164) ([excpt](https://github.com/excpt))
33
+ - Fix \#151 and code refactoring [\#163](https://github.com/jwt/ruby-jwt/pull/163) ([excpt](https://github.com/excpt))
34
+ - Signature validation before claim verification [\#160](https://github.com/jwt/ruby-jwt/pull/160) ([excpt](https://github.com/excpt))
35
+ - Create specs for README.md examples [\#159](https://github.com/jwt/ruby-jwt/pull/159) ([excpt](https://github.com/excpt))
36
+ - Tiny Readme Improvement [\#156](https://github.com/jwt/ruby-jwt/pull/156) ([b264](https://github.com/b264))
37
+ - Added test execution to Rakefile [\#147](https://github.com/jwt/ruby-jwt/pull/147) ([jabbrwcky](https://github.com/jabbrwcky))
38
+ - Add more bling bling to the site [\#146](https://github.com/jwt/ruby-jwt/pull/146) ([excpt](https://github.com/excpt))
39
+ - Bump version [\#145](https://github.com/jwt/ruby-jwt/pull/145) ([excpt](https://github.com/excpt))
40
+ - Add first content and basic layout [\#144](https://github.com/jwt/ruby-jwt/pull/144) ([excpt](https://github.com/excpt))
41
+ - Add a changelog file [\#142](https://github.com/jwt/ruby-jwt/pull/142) ([excpt](https://github.com/excpt))
42
+ - Return decoded\_segments [\#139](https://github.com/jwt/ruby-jwt/pull/139) ([akostrikov](https://github.com/akostrikov))
43
+
44
+ ## [v1.5.4](https://github.com/jwt/ruby-jwt/tree/v1.5.4) (2016-03-24)
45
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.3...v1.5.4)
46
+
47
+ **Closed issues:**
48
+
49
+ - 404 at https://rubygems.global.ssl.fastly.net/gems/jwt-1.5.3.gem [\#137](https://github.com/jwt/ruby-jwt/issues/137)
50
+
51
+ **Merged pull requests:**
52
+
53
+ - Update README.md [\#138](https://github.com/jwt/ruby-jwt/pull/138) ([excpt](https://github.com/excpt))
54
+ - Fix base64url\_decode [\#136](https://github.com/jwt/ruby-jwt/pull/136) ([excpt](https://github.com/excpt))
55
+ - Fix ruby 1.9.3 compatibility [\#135](https://github.com/jwt/ruby-jwt/pull/135) ([excpt](https://github.com/excpt))
56
+ - iat can be a float value [\#134](https://github.com/jwt/ruby-jwt/pull/134) ([llimllib](https://github.com/llimllib))
57
+
58
+ ## [v1.5.3](https://github.com/jwt/ruby-jwt/tree/v1.5.3) (2016-02-24)
59
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.5.2...v1.5.3)
60
+
61
+ **Implemented enhancements:**
62
+
63
+ - Refactor obsolete code for ruby 1.8 support [\#120](https://github.com/jwt/ruby-jwt/issues/120)
64
+ - Fix "Rubocop/Metrics/CyclomaticComplexity" issue in lib/jwt.rb [\#106](https://github.com/jwt/ruby-jwt/issues/106)
65
+ - Fix "Rubocop/Metrics/CyclomaticComplexity" issue in lib/jwt.rb [\#105](https://github.com/jwt/ruby-jwt/issues/105)
66
+ - Allow a proc to be passed for JTI verification [\#126](https://github.com/jwt/ruby-jwt/pull/126) ([yahooguntu](https://github.com/yahooguntu))
67
+ - Relax restrictions on "jti" claim verification [\#113](https://github.com/jwt/ruby-jwt/pull/113) ([lwe](https://github.com/lwe))
68
+
69
+ **Closed issues:**
70
+
71
+ - Verifications not functioning in latest release [\#128](https://github.com/jwt/ruby-jwt/issues/128)
72
+ - Base64 is generating invalid length base64 strings - cross language interop [\#127](https://github.com/jwt/ruby-jwt/issues/127)
73
+ - Digest::Digest is deprecated; use Digest [\#119](https://github.com/jwt/ruby-jwt/issues/119)
74
+ - verify\_rsa no method 'verify' for class String [\#115](https://github.com/jwt/ruby-jwt/issues/115)
75
+ - Add a changelog [\#111](https://github.com/jwt/ruby-jwt/issues/111)
76
+
77
+ **Merged pull requests:**
78
+
79
+ - Drop ruby 1.9.3 support [\#131](https://github.com/jwt/ruby-jwt/pull/131) ([excpt](https://github.com/excpt))
80
+ - Allow string hash keys in validation configurations [\#130](https://github.com/jwt/ruby-jwt/pull/130) ([tpickett66](https://github.com/tpickett66))
81
+ - Add ruby 2.3.0 for travis ci testing [\#123](https://github.com/jwt/ruby-jwt/pull/123) ([excpt](https://github.com/excpt))
82
+ - Remove obsolete json code [\#122](https://github.com/jwt/ruby-jwt/pull/122) ([excpt](https://github.com/excpt))
83
+ - Add fancy badges to README.md [\#118](https://github.com/jwt/ruby-jwt/pull/118) ([excpt](https://github.com/excpt))
84
+ - Refactor decode and verify functionality [\#117](https://github.com/jwt/ruby-jwt/pull/117) ([excpt](https://github.com/excpt))
85
+ - Drop echoe dependency for gem releases [\#116](https://github.com/jwt/ruby-jwt/pull/116) ([excpt](https://github.com/excpt))
86
+ - Updated readme for iss/aud options [\#114](https://github.com/jwt/ruby-jwt/pull/114) ([ryanmcilmoyl](https://github.com/ryanmcilmoyl))
87
+ - Fix error misspelling [\#112](https://github.com/jwt/ruby-jwt/pull/112) ([kat3kasper](https://github.com/kat3kasper))
88
+
89
+ ## [jwt-1.5.2](https://github.com/jwt/ruby-jwt/tree/jwt-1.5.2) (2015-10-27)
90
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.5.1...jwt-1.5.2)
91
+
92
+ **Implemented enhancements:**
93
+
94
+ - Must we specify algorithm when calling decode to avoid vulnerabilities? [\#107](https://github.com/jwt/ruby-jwt/issues/107)
95
+ - Code review: Rspec test refactoring [\#85](https://github.com/jwt/ruby-jwt/pull/85) ([excpt](https://github.com/excpt))
96
+
97
+ **Fixed bugs:**
98
+
99
+ - aud verifies if aud is passed in, :sub does not [\#102](https://github.com/jwt/ruby-jwt/issues/102)
100
+ - iat check does not use leeway so nbf could pass, but iat fail [\#83](https://github.com/jwt/ruby-jwt/issues/83)
101
+
102
+ **Closed issues:**
103
+
104
+ - Test ticket from Code Climate [\#104](https://github.com/jwt/ruby-jwt/issues/104)
105
+ - Test ticket from Code Climate [\#100](https://github.com/jwt/ruby-jwt/issues/100)
106
+ - Is it possible to decode the payload without validating the signature? [\#97](https://github.com/jwt/ruby-jwt/issues/97)
107
+ - What is audience? [\#96](https://github.com/jwt/ruby-jwt/issues/96)
108
+ - Options hash uses both symbols and strings as keys. [\#95](https://github.com/jwt/ruby-jwt/issues/95)
109
+
110
+ **Merged pull requests:**
111
+
112
+ - Fix incorrect `iat` examples [\#109](https://github.com/jwt/ruby-jwt/pull/109) ([kjwierenga](https://github.com/kjwierenga))
113
+ - Update docs to include instructions for the algorithm parameter. [\#108](https://github.com/jwt/ruby-jwt/pull/108) ([aarongray](https://github.com/aarongray))
114
+ - make sure :sub check behaves like :aud check [\#103](https://github.com/jwt/ruby-jwt/pull/103) ([skippy](https://github.com/skippy))
115
+ - Change hash syntax [\#101](https://github.com/jwt/ruby-jwt/pull/101) ([excpt](https://github.com/excpt))
116
+ - Include LICENSE and README.md in gem [\#99](https://github.com/jwt/ruby-jwt/pull/99) ([bkeepers](https://github.com/bkeepers))
117
+ - Remove unused variable in the sample code. [\#98](https://github.com/jwt/ruby-jwt/pull/98) ([hypermkt](https://github.com/hypermkt))
118
+ - Fix iat claim example [\#94](https://github.com/jwt/ruby-jwt/pull/94) ([larrylv](https://github.com/larrylv))
119
+ - Fix wrong description in README.md [\#93](https://github.com/jwt/ruby-jwt/pull/93) ([larrylv](https://github.com/larrylv))
120
+ - JWT and JWA are now RFC. [\#92](https://github.com/jwt/ruby-jwt/pull/92) ([aj-michael](https://github.com/aj-michael))
121
+ - Update README.md [\#91](https://github.com/jwt/ruby-jwt/pull/91) ([nsarno](https://github.com/nsarno))
122
+ - Fix missing verify parameter in docs [\#90](https://github.com/jwt/ruby-jwt/pull/90) ([ernie](https://github.com/ernie))
123
+ - Iat check uses leeway. [\#89](https://github.com/jwt/ruby-jwt/pull/89) ([aj-michael](https://github.com/aj-michael))
124
+ - nbf check allows exact time matches. [\#88](https://github.com/jwt/ruby-jwt/pull/88) ([aj-michael](https://github.com/aj-michael))
125
+
126
+ ## [jwt-1.5.1](https://github.com/jwt/ruby-jwt/tree/jwt-1.5.1) (2015-06-22)
127
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.5.0...jwt-1.5.1)
128
+
129
+ **Implemented enhancements:**
130
+
131
+ - Fix either README or source code [\#78](https://github.com/jwt/ruby-jwt/issues/78)
132
+ - Validate against draft 20 [\#38](https://github.com/jwt/ruby-jwt/issues/38)
133
+
134
+ **Fixed bugs:**
135
+
136
+ - ECDSA signature verification fails for valid tokens [\#84](https://github.com/jwt/ruby-jwt/issues/84)
137
+ - Shouldn't verification of additional claims, like iss, aud etc. be enforced when in options? [\#81](https://github.com/jwt/ruby-jwt/issues/81)
138
+ - Fix either README or source code [\#78](https://github.com/jwt/ruby-jwt/issues/78)
139
+ - decode fails with 'none' algorithm and verify [\#75](https://github.com/jwt/ruby-jwt/issues/75)
140
+
141
+ **Closed issues:**
142
+
143
+ - Doc mismatch: uninitialized constant JWT::ExpiredSignature [\#79](https://github.com/jwt/ruby-jwt/issues/79)
144
+ - TypeError when specifying a wrong algorithm [\#77](https://github.com/jwt/ruby-jwt/issues/77)
145
+ - jti verification doesn't prevent replays [\#73](https://github.com/jwt/ruby-jwt/issues/73)
146
+
147
+ **Merged pull requests:**
148
+
149
+ - Correctly sign ECDSA JWTs [\#87](https://github.com/jwt/ruby-jwt/pull/87) ([jurriaan](https://github.com/jurriaan))
150
+ - fixed results of decoded tokens in readme [\#86](https://github.com/jwt/ruby-jwt/pull/86) ([piscolomo](https://github.com/piscolomo))
151
+ - Force verification of "iss" and "aud" claims [\#82](https://github.com/jwt/ruby-jwt/pull/82) ([lwe](https://github.com/lwe))
152
+
153
+ ## [jwt-1.5.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.5.0) (2015-05-09)
154
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.4.1...jwt-1.5.0)
155
+
156
+ **Implemented enhancements:**
157
+
158
+ - Needs to support asymmetric key signatures over shared secrets [\#46](https://github.com/jwt/ruby-jwt/issues/46)
159
+ - Implement Elliptic Curve Crypto Signatures [\#74](https://github.com/jwt/ruby-jwt/pull/74) ([jtdowney](https://github.com/jtdowney))
160
+ - Add an option to verify the signature on decode [\#71](https://github.com/jwt/ruby-jwt/pull/71) ([javawizard](https://github.com/javawizard))
161
+
162
+ **Closed issues:**
163
+
164
+ - Check JWT vulnerability [\#76](https://github.com/jwt/ruby-jwt/issues/76)
165
+
166
+ **Merged pull requests:**
167
+
168
+ - Fixed some examples to make them copy-pastable [\#72](https://github.com/jwt/ruby-jwt/pull/72) ([jer](https://github.com/jer))
169
+
170
+ ## [jwt-1.4.1](https://github.com/jwt/ruby-jwt/tree/jwt-1.4.1) (2015-03-12)
171
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.4.0...jwt-1.4.1)
172
+
173
+ **Fixed bugs:**
174
+
175
+ - jti verification not working per the spec [\#68](https://github.com/jwt/ruby-jwt/issues/68)
176
+ - Verify ISS should be off by default [\#66](https://github.com/jwt/ruby-jwt/issues/66)
177
+
178
+ **Merged pull requests:**
179
+
180
+ - Fix \#66 \#68 [\#69](https://github.com/jwt/ruby-jwt/pull/69) ([excpt](https://github.com/excpt))
181
+ - When throwing errors, mention expected/received values [\#65](https://github.com/jwt/ruby-jwt/pull/65) ([rolodato](https://github.com/rolodato))
182
+
183
+ ## [jwt-1.4.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.4.0) (2015-03-10)
184
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.3.0...jwt-1.4.0)
185
+
186
+ **Closed issues:**
187
+
188
+ - The behavior using 'json' differs from 'multi\_json' [\#41](https://github.com/jwt/ruby-jwt/issues/41)
189
+
190
+ **Merged pull requests:**
191
+
192
+ - Release 1.4.0 [\#64](https://github.com/jwt/ruby-jwt/pull/64) ([excpt](https://github.com/excpt))
193
+ - Update README.md and remove dead code [\#63](https://github.com/jwt/ruby-jwt/pull/63) ([excpt](https://github.com/excpt))
194
+ - Add 'iat/ aud/ sub/ jti' support for ruby-jwt [\#62](https://github.com/jwt/ruby-jwt/pull/62) ([ZhangHanDong](https://github.com/ZhangHanDong))
195
+ - Add 'iss' support for ruby-jwt [\#61](https://github.com/jwt/ruby-jwt/pull/61) ([ZhangHanDong](https://github.com/ZhangHanDong))
196
+ - Clarify .encode API in README [\#60](https://github.com/jwt/ruby-jwt/pull/60) ([jbodah](https://github.com/jbodah))
197
+
198
+ ## [jwt-1.3.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.3.0) (2015-02-24)
199
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.2.1...jwt-1.3.0)
200
+
201
+ **Closed issues:**
202
+
203
+ - Signature Verification to Return Verification Error rather than decode error [\#57](https://github.com/jwt/ruby-jwt/issues/57)
204
+ - Incorrect readme for leeway [\#55](https://github.com/jwt/ruby-jwt/issues/55)
205
+ - What is the reason behind stripping the = in base64 encoding? [\#54](https://github.com/jwt/ruby-jwt/issues/54)
206
+ - Preperations for version 2.x [\#50](https://github.com/jwt/ruby-jwt/issues/50)
207
+ - Release a new version [\#47](https://github.com/jwt/ruby-jwt/issues/47)
208
+ - Catch up for ActiveWhatever 4.1.1 series [\#40](https://github.com/jwt/ruby-jwt/issues/40)
209
+
210
+ **Merged pull requests:**
211
+
212
+ - raise verification error for signiture verification [\#58](https://github.com/jwt/ruby-jwt/pull/58) ([punkle](https://github.com/punkle))
213
+ - Added support for not before claim verification [\#56](https://github.com/jwt/ruby-jwt/pull/56) ([punkle](https://github.com/punkle))
214
+ - Preperations for version 2.x [\#49](https://github.com/jwt/ruby-jwt/pull/49) ([excpt](https://github.com/excpt))
215
+
216
+ ## [jwt-1.2.1](https://github.com/jwt/ruby-jwt/tree/jwt-1.2.1) (2015-01-22)
217
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.2.0...jwt-1.2.1)
218
+
219
+ **Closed issues:**
220
+
221
+ - JWT.encode\({"exp": 10}, "secret"\) [\#52](https://github.com/jwt/ruby-jwt/issues/52)
222
+ - JWT.encode\({"exp": 10}, "secret"\) [\#51](https://github.com/jwt/ruby-jwt/issues/51)
223
+
224
+ **Merged pull requests:**
225
+
226
+ - Accept expiration claims as string [\#53](https://github.com/jwt/ruby-jwt/pull/53) ([yarmand](https://github.com/yarmand))
227
+
228
+ ## [jwt-1.2.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.2.0) (2014-11-24)
229
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.13...jwt-1.2.0)
230
+
231
+ **Closed issues:**
232
+
233
+ - set token to expire [\#42](https://github.com/jwt/ruby-jwt/issues/42)
234
+
235
+ **Merged pull requests:**
236
+
237
+ - Added support for `exp` claim [\#45](https://github.com/jwt/ruby-jwt/pull/45) ([zshannon](https://github.com/zshannon))
238
+ - rspec 3 breaks passing tests [\#44](https://github.com/jwt/ruby-jwt/pull/44) ([zshannon](https://github.com/zshannon))
239
+
240
+ ## [jwt-0.1.13](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.13) (2014-05-08)
241
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.0.0...jwt-0.1.13)
242
+
243
+ **Closed issues:**
244
+
245
+ - yanking of version 0.1.12 causes issues [\#39](https://github.com/jwt/ruby-jwt/issues/39)
246
+ - Semantic versioning [\#37](https://github.com/jwt/ruby-jwt/issues/37)
247
+ - Update gem to get latest changes [\#36](https://github.com/jwt/ruby-jwt/issues/36)
248
+
249
+ ## [jwt-1.0.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.0.0) (2014-05-07)
250
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.11...jwt-1.0.0)
251
+
252
+ **Closed issues:**
253
+
254
+ - API request - JWT::decoded\_header\(\) [\#26](https://github.com/jwt/ruby-jwt/issues/26)
255
+
256
+ **Merged pull requests:**
257
+
258
+ - return header along with playload after decoding [\#35](https://github.com/jwt/ruby-jwt/pull/35) ([sawyerzhang](https://github.com/sawyerzhang))
259
+ - Raise JWT::DecodeError on nil token [\#34](https://github.com/jwt/ruby-jwt/pull/34) ([tjmw](https://github.com/tjmw))
260
+ - Make MultiJson optional for Ruby 1.9+ [\#33](https://github.com/jwt/ruby-jwt/pull/33) ([petergoldstein](https://github.com/petergoldstein))
261
+ - Allow access to header and payload without signature verification [\#32](https://github.com/jwt/ruby-jwt/pull/32) ([petergoldstein](https://github.com/petergoldstein))
262
+ - Update specs to use RSpec 3.0.x syntax [\#31](https://github.com/jwt/ruby-jwt/pull/31) ([petergoldstein](https://github.com/petergoldstein))
263
+ - Travis - Add Ruby 2.0.0, 2.1.0, Rubinius [\#30](https://github.com/jwt/ruby-jwt/pull/30) ([petergoldstein](https://github.com/petergoldstein))
264
+
265
+ ## [jwt-0.1.11](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.11) (2014-01-17)
266
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.10...jwt-0.1.11)
267
+
268
+ **Closed issues:**
269
+
270
+ - url safe encode and decode [\#28](https://github.com/jwt/ruby-jwt/issues/28)
271
+ - Release [\#27](https://github.com/jwt/ruby-jwt/issues/27)
272
+
273
+ **Merged pull requests:**
274
+
275
+ - fixed urlsafe base64 encoding [\#29](https://github.com/jwt/ruby-jwt/pull/29) ([tobscher](https://github.com/tobscher))
276
+
277
+ ## [jwt-0.1.10](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.10) (2014-01-10)
278
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.8...jwt-0.1.10)
279
+
280
+ **Closed issues:**
281
+
282
+ - change to signature of JWT.decode method [\#14](https://github.com/jwt/ruby-jwt/issues/14)
283
+
284
+ **Merged pull requests:**
285
+
286
+ - Fix warning: assigned but unused variable - e [\#25](https://github.com/jwt/ruby-jwt/pull/25) ([sferik](https://github.com/sferik))
287
+ - Echoe doesn't define a license= method [\#24](https://github.com/jwt/ruby-jwt/pull/24) ([sferik](https://github.com/sferik))
288
+ - Use OpenSSL::Digest instead of deprecated OpenSSL::Digest::Digest [\#23](https://github.com/jwt/ruby-jwt/pull/23) ([JuanitoFatas](https://github.com/JuanitoFatas))
289
+ - Handle some invalid JWTs [\#22](https://github.com/jwt/ruby-jwt/pull/22) ([steved](https://github.com/steved))
290
+ - Add MIT license to gemspec [\#21](https://github.com/jwt/ruby-jwt/pull/21) ([nycvotes-dev](https://github.com/nycvotes-dev))
291
+ - Tweaks and improvements [\#20](https://github.com/jwt/ruby-jwt/pull/20) ([threedaymonk](https://github.com/threedaymonk))
292
+ - Don't leave errors in OpenSSL.errors when there is a decoding error. [\#19](https://github.com/jwt/ruby-jwt/pull/19) ([lowellk](https://github.com/lowellk))
293
+
294
+ ## [jwt-0.1.8](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.8) (2013-03-14)
295
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.7...jwt-0.1.8)
296
+
297
+ **Merged pull requests:**
298
+
299
+ - Contrib and update [\#18](https://github.com/jwt/ruby-jwt/pull/18) ([threedaymonk](https://github.com/threedaymonk))
300
+ - Verify if verify is truthy \(not just true\) [\#17](https://github.com/jwt/ruby-jwt/pull/17) ([threedaymonk](https://github.com/threedaymonk))
301
+
302
+ ## [jwt-0.1.7](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.7) (2013-03-07)
303
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.6...jwt-0.1.7)
304
+
305
+ **Merged pull requests:**
306
+
307
+ - Catch MultiJson::LoadError and reraise as JWT::DecodeError [\#16](https://github.com/jwt/ruby-jwt/pull/16) ([rwygand](https://github.com/rwygand))
308
+
309
+ ## [jwt-0.1.6](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.6) (2013-03-05)
310
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.5...jwt-0.1.6)
311
+
312
+ **Merged pull requests:**
313
+
314
+ - Fixes a theoretical timing attack [\#15](https://github.com/jwt/ruby-jwt/pull/15) ([mgates](https://github.com/mgates))
315
+ - Use StandardError as parent for DecodeError [\#13](https://github.com/jwt/ruby-jwt/pull/13) ([Oscil8](https://github.com/Oscil8))
316
+
317
+ ## [jwt-0.1.5](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.5) (2012-07-20)
318
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.4...jwt-0.1.5)
319
+
320
+ **Closed issues:**
321
+
322
+ - Unable to specify signature header fields [\#7](https://github.com/jwt/ruby-jwt/issues/7)
323
+
324
+ **Merged pull requests:**
325
+
326
+ - MultiJson dependency uses ~\> but should be \>= [\#12](https://github.com/jwt/ruby-jwt/pull/12) ([sporkmonger](https://github.com/sporkmonger))
327
+ - Oops. :-\) [\#11](https://github.com/jwt/ruby-jwt/pull/11) ([sporkmonger](https://github.com/sporkmonger))
328
+ - Fix issue with signature verification in JRuby [\#10](https://github.com/jwt/ruby-jwt/pull/10) ([sporkmonger](https://github.com/sporkmonger))
329
+ - Depend on MultiJson [\#9](https://github.com/jwt/ruby-jwt/pull/9) ([lautis](https://github.com/lautis))
330
+ - Allow for custom headers on encode and decode [\#8](https://github.com/jwt/ruby-jwt/pull/8) ([dgrijalva](https://github.com/dgrijalva))
331
+ - Missing development dependency for echoe gem. [\#6](https://github.com/jwt/ruby-jwt/pull/6) ([sporkmonger](https://github.com/sporkmonger))
332
+
333
+ ## [jwt-0.1.4](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.4) (2011-11-11)
334
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.3...jwt-0.1.4)
335
+
336
+ **Merged pull requests:**
337
+
338
+ - Fix for RSA verification [\#5](https://github.com/jwt/ruby-jwt/pull/5) ([jordan-brough](https://github.com/jordan-brough))
339
+
340
+ ## [jwt-0.1.3](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.3) (2011-06-30)
341
+ **Closed issues:**
342
+
343
+ - signatures calculated incorrectly \(hexdigest instead of digest\) [\#1](https://github.com/jwt/ruby-jwt/issues/1)
344
+
345
+ **Merged pull requests:**
346
+
347
+ - Bumped a version and added a .gemspec using rake build\_gemspec [\#3](https://github.com/jwt/ruby-jwt/pull/3) ([zhitomirskiyi](https://github.com/zhitomirskiyi))
348
+ - Added RSA support [\#2](https://github.com/jwt/ruby-jwt/pull/2) ([zhitomirskiyi](https://github.com/zhitomirskiyi))
349
+
350
+
351
+
352
+ \* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
data/README.md CHANGED
@@ -12,7 +12,7 @@ If you have further questions releated to development or usage, join us: [ruby-j
12
12
  ## Announcements
13
13
 
14
14
  * Ruby 1.9.3 support will be dropped by December 31st, 2016.
15
- * Version 1.5.3 yanked. See: #132 and #133
15
+ * Version 1.5.3 yanked. See: [#132](https://github.com/jwt/ruby-jwt/issues/132) and [#133](https://github.com/jwt/ruby-jwt/issues/133)
16
16
 
17
17
  ## Installing
18
18
 
@@ -46,7 +46,7 @@ payload = {:data => 'test'}
46
46
  # IMPORTANT: set nil as password parameter
47
47
  token = JWT.encode payload, nil, 'none'
48
48
 
49
- # eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJ0ZXN0IjoiZGF0YSJ9.
49
+ # eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJkYXRhIjoidGVzdCJ9.
50
50
  puts token
51
51
 
52
52
  # Set password to nil and validation to false otherwise this won't work
@@ -62,8 +62,8 @@ puts decoded_token
62
62
 
63
63
  **HMAC** (default: HS256)
64
64
 
65
- * HS256 - HMAC using SHA-256 hash algorithm (default)
66
- * HS384 - HMAC using SHA-384 hash algorithm
65
+ * HS256 - HMAC using SHA-256 hash algorithm (default)
66
+ * HS384 - HMAC using SHA-384 hash algorithm
67
67
  * HS512 - HMAC using SHA-512 hash algorithm
68
68
 
69
69
  ```ruby
@@ -71,7 +71,7 @@ hmac_secret = 'my$ecretK3y'
71
71
 
72
72
  token = JWT.encode payload, hmac_secret, 'HS256'
73
73
 
74
- # eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZXN0IjoiZGF0YSJ9._sLPAGP-IXgho8BkMGQ86N2mah7vDyn0L5hOR4UkfoI
74
+ # eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoidGVzdCJ9.ZxW8go9hz3ETCSfxFxpwSkYg_602gOPKearsf6DsxgY
75
75
  puts token
76
76
 
77
77
  decoded_token = JWT.decode token, hmac_secret, true, { :algorithm => 'HS256' }
data/Rakefile CHANGED
@@ -1 +1,11 @@
1
1
  require 'bundler/gem_tasks'
2
+
3
+ begin
4
+ require 'rspec/core/rake_task'
5
+
6
+ RSpec::Core::RakeTask.new(:test)
7
+
8
+ task default: :test
9
+ rescue LoadError
10
+ puts 'RSpec rake tasks not available. Please run "bundle install" to install missing dependencies.'
11
+ end
data/lib/jwt.rb CHANGED
@@ -15,7 +15,7 @@ module JWT
15
15
  'prime256v1' => 'ES256',
16
16
  'secp384r1' => 'ES384',
17
17
  'secp521r1' => 'ES512'
18
- }
18
+ }.freeze
19
19
 
20
20
  module_function
21
21
 
@@ -27,7 +27,7 @@ module JWT
27
27
  elsif %w(ES256 ES384 ES512).include?(algorithm)
28
28
  sign_ecdsa(algorithm, msg, key)
29
29
  else
30
- fail NotImplementedError, 'Unsupported signing method'
30
+ raise NotImplementedError, 'Unsupported signing method'
31
31
  end
32
32
  end
33
33
 
@@ -38,7 +38,7 @@ module JWT
38
38
  def sign_ecdsa(algorithm, msg, private_key)
39
39
  key_algorithm = NAMED_CURVES[private_key.group.curve_name]
40
40
  if algorithm != key_algorithm
41
- fail IncorrectAlgorithm, "payload algorithm is #{algorithm} but #{key_algorithm} signing key was provided"
41
+ raise IncorrectAlgorithm, "payload algorithm is #{algorithm} but #{key_algorithm} signing key was provided"
42
42
  end
43
43
 
44
44
  digest = OpenSSL::Digest.new(algorithm.sub('ES', 'sha'))
@@ -52,7 +52,7 @@ module JWT
52
52
  def verify_ecdsa(algorithm, public_key, signing_input, signature)
53
53
  key_algorithm = NAMED_CURVES[public_key.group.curve_name]
54
54
  if algorithm != key_algorithm
55
- fail IncorrectAlgorithm, "payload algorithm is #{algorithm} but #{key_algorithm} verification key was provided"
55
+ raise IncorrectAlgorithm, "payload algorithm is #{algorithm} but #{key_algorithm} verification key was provided"
56
56
  end
57
57
 
58
58
  digest = OpenSSL::Digest.new(algorithm.sub('ES', 'sha'))
@@ -73,6 +73,7 @@ module JWT
73
73
  end
74
74
 
75
75
  def encoded_payload(payload)
76
+ raise InvalidPayload, "exp claim must be an integer" if payload['exp'] && payload['exp'].is_a?(Time)
76
77
  base64url_encode(encode_json(payload))
77
78
  end
78
79
 
@@ -94,8 +95,29 @@ module JWT
94
95
  segments.join('.')
95
96
  end
96
97
 
98
+ def decoded_segments(jwt, key = nil, verify = true, custom_options = {}, &keyfinder)
99
+ raise(JWT::DecodeError, 'Nil JSON web token') unless jwt
100
+
101
+ options = {
102
+ verify_expiration: true,
103
+ verify_not_before: true,
104
+ verify_iss: false,
105
+ verify_iat: false,
106
+ verify_jti: false,
107
+ verify_aud: false,
108
+ verify_sub: false,
109
+ leeway: 0
110
+ }
111
+
112
+ merged_options = options.merge(custom_options)
113
+
114
+ decoder = Decode.new jwt, key, verify, merged_options, &keyfinder
115
+ decoder.decode_segments
116
+ end
117
+
118
+
97
119
  def decode(jwt, key = nil, verify = true, custom_options = {}, &keyfinder)
98
- fail(JWT::DecodeError, 'Nil JSON web token') unless jwt
120
+ raise(JWT::DecodeError, 'Nil JSON web token') unless jwt
99
121
 
100
122
  options = {
101
123
  verify_expiration: true,
@@ -112,35 +134,36 @@ module JWT
112
134
 
113
135
  decoder = Decode.new jwt, key, verify, merged_options, &keyfinder
114
136
  header, payload, signature, signing_input = decoder.decode_segments
115
- decoder.verify
116
-
117
- fail(JWT::DecodeError, 'Not enough or too many segments') unless header && payload
118
137
 
119
138
  if verify
120
139
  algo, key = signature_algorithm_and_key(header, key, &keyfinder)
121
140
  if merged_options[:algorithm] && algo != merged_options[:algorithm]
122
- fail JWT::IncorrectAlgorithm, 'Expected a different algorithm'
141
+ raise JWT::IncorrectAlgorithm, 'Expected a different algorithm'
123
142
  end
124
143
  verify_signature(algo, key, signing_input, signature)
125
144
  end
126
145
 
146
+ decoder.verify
147
+
148
+ raise(JWT::DecodeError, 'Not enough or too many segments') unless header && payload
149
+
127
150
  [payload, header]
128
151
  end
129
152
 
130
153
  def signature_algorithm_and_key(header, key, &keyfinder)
131
- key = keyfinder.call(header) if keyfinder
154
+ key = yield(header) if keyfinder
132
155
  [header['alg'], key]
133
156
  end
134
157
 
135
158
  def verify_signature(algo, key, signing_input, signature)
136
159
  if %w(HS256 HS384 HS512).include?(algo)
137
- fail(JWT::VerificationError, 'Signature verification raised') unless secure_compare(signature, sign_hmac(algo, signing_input, key))
160
+ raise(JWT::VerificationError, 'Signature verification raised') unless secure_compare(signature, sign_hmac(algo, signing_input, key))
138
161
  elsif %w(RS256 RS384 RS512).include?(algo)
139
- fail(JWT::VerificationError, 'Signature verification raised') unless verify_rsa(algo, key, signing_input, signature)
162
+ raise(JWT::VerificationError, 'Signature verification raised') unless verify_rsa(algo, key, signing_input, signature)
140
163
  elsif %w(ES256 ES384 ES512).include?(algo)
141
- fail(JWT::VerificationError, 'Signature verification raised') unless verify_ecdsa(algo, key, signing_input, signature)
164
+ raise(JWT::VerificationError, 'Signature verification raised') unless verify_ecdsa(algo, key, signing_input, signature)
142
165
  else
143
- fail JWT::VerificationError, 'Algorithm not supported'
166
+ raise JWT::VerificationError, 'Algorithm not supported'
144
167
  end
145
168
  rescue OpenSSL::PKey::PKeyError
146
169
  raise JWT::VerificationError, 'Signature verification raised'
data/lib/jwt/error.rb CHANGED
@@ -9,4 +9,5 @@ module JWT
9
9
  class InvalidAudError < DecodeError; end
10
10
  class InvalidSubError < DecodeError; end
11
11
  class InvalidJtiError < DecodeError; end
12
+ class InvalidPayload < DecodeError; end
12
13
  end
data/lib/jwt/verify.rb CHANGED
@@ -1,10 +1,11 @@
1
+ # frozen_string_literal: true
1
2
  require 'jwt/error'
2
3
 
3
4
  module JWT
4
5
  # JWT verify methods
5
6
  class Verify
6
7
  class << self
7
- %w[verify_aud verify_expiration verify_iat verify_iss verify_jti verify_not_before verify_sub].each do |method_name|
8
+ %w(verify_aud verify_expiration verify_iat verify_iss verify_jti verify_not_before verify_sub).each do |method_name|
8
9
  define_method method_name do |payload, options|
9
10
  new(payload, options).send(method_name)
10
11
  end
@@ -20,12 +21,21 @@ module JWT
20
21
  return unless (options_aud = extract_option(:aud))
21
22
 
22
23
  if @payload['aud'].is_a?(Array)
23
- fail(
24
- JWT::InvalidAudError,
25
- 'Invalid audience'
26
- ) unless @payload['aud'].include?(options_aud.to_s)
24
+ if options_aud.is_a?(Array)
25
+ options_aud.each do |aud|
26
+ raise(
27
+ JWT::InvalidAudError,
28
+ 'Invalid audience'
29
+ ) unless @payload['aud'].include?(aud)
30
+ end
31
+ else
32
+ raise(
33
+ JWT::InvalidAudError,
34
+ 'Invalid audience'
35
+ ) unless @payload['aud'].include?(options_aud)
36
+ end
27
37
  else
28
- fail(
38
+ raise(
29
39
  JWT::InvalidAudError,
30
40
  "Invalid audience. Expected #{options_aud}, received #{@payload['aud'] || '<none>'}"
31
41
  ) unless @payload['aud'].to_s == options_aud.to_s
@@ -35,16 +45,16 @@ module JWT
35
45
  def verify_expiration
36
46
  return unless @payload.include?('exp')
37
47
 
38
- if @payload['exp'].to_i < (Time.now.to_i - leeway)
39
- fail(JWT::ExpiredSignature, 'Signature has expired')
48
+ if @payload['exp'].to_i <= (Time.now.to_i - leeway)
49
+ raise(JWT::ExpiredSignature, 'Signature has expired')
40
50
  end
41
51
  end
42
52
 
43
53
  def verify_iat
44
54
  return unless @payload.include?('iat')
45
55
 
46
- if !(@payload['iat'].is_a?(Numeric)) || @payload['iat'].to_f > (Time.now.to_f + leeway)
47
- fail(JWT::InvalidIatError, 'Invalid iat')
56
+ if !@payload['iat'].is_a?(Numeric) || @payload['iat'].to_f > (Time.now.to_f + leeway)
57
+ raise(JWT::InvalidIatError, 'Invalid iat')
48
58
  end
49
59
  end
50
60
 
@@ -52,7 +62,7 @@ module JWT
52
62
  return unless (options_iss = extract_option(:iss))
53
63
 
54
64
  if @payload['iss'].to_s != options_iss.to_s
55
- fail(
65
+ raise(
56
66
  JWT::InvalidIssuerError,
57
67
  "Invalid issuer. Expected #{options_iss}, received #{@payload['iss'] || '<none>'}"
58
68
  )
@@ -62,9 +72,9 @@ module JWT
62
72
  def verify_jti
63
73
  options_verify_jti = extract_option(:verify_jti)
64
74
  if options_verify_jti.respond_to?(:call)
65
- fail(JWT::InvalidJtiError, 'Invalid jti') unless options_verify_jti.call(@payload['jti'])
75
+ raise(JWT::InvalidJtiError, 'Invalid jti') unless options_verify_jti.call(@payload['jti'])
66
76
  else
67
- fail(JWT::InvalidJtiError, 'Missing jti') if @payload['jti'].to_s.strip.empty?
77
+ raise(JWT::InvalidJtiError, 'Missing jti') if @payload['jti'].to_s.strip.empty?
68
78
  end
69
79
  end
70
80
 
@@ -72,14 +82,14 @@ module JWT
72
82
  return unless @payload.include?('nbf')
73
83
 
74
84
  if @payload['nbf'].to_i > (Time.now.to_i + leeway)
75
- fail(JWT::ImmatureSignature, 'Signature nbf has not been reached')
85
+ raise(JWT::ImmatureSignature, 'Signature nbf has not been reached')
76
86
  end
77
87
  end
78
88
 
79
89
  def verify_sub
80
90
  return unless (options_sub = extract_option(:sub))
81
91
 
82
- fail(
92
+ raise(
83
93
  JWT::InvalidSubError,
84
94
  "Invalid subject. Expected #{options_sub}, received #{@payload['sub'] || '<none>'}"
85
95
  ) unless @payload['sub'].to_s == options_sub.to_s
data/lib/jwt/version.rb CHANGED
@@ -13,9 +13,9 @@ module JWT
13
13
  # minor version
14
14
  MINOR = 5
15
15
  # tiny version
16
- TINY = 4
16
+ TINY = 5
17
17
  # alpha, beta, etc. tag
18
- PRE = nil
18
+ PRE = nil
19
19
 
20
20
  # Build version string
21
21
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
data/ruby-jwt.gemspec CHANGED
@@ -22,6 +22,7 @@ Gem::Specification.new do |spec|
22
22
 
23
23
  spec.add_development_dependency 'bundler'
24
24
  spec.add_development_dependency 'rake'
25
+ spec.add_development_dependency 'json', '< 2.0'
25
26
  spec.add_development_dependency 'rspec'
26
27
  spec.add_development_dependency 'simplecov'
27
28
  spec.add_development_dependency 'simplecov-json'
data/spec/integration/readme_examples_spec.rb ADDED
@@ -0,0 +1,190 @@
1
+ # frozen_string_literal: true
2
+ require_relative '../spec_helper'
3
+ require 'jwt'
4
+
5
+ describe 'README.md code test' do
6
+ context 'algorithm usage' do
7
+ let(:payload) { { data: 'test' } }
8
+
9
+ it 'NONE' do
10
+ token = JWT.encode payload, nil, 'none'
11
+ decoded_token = JWT.decode token, nil, false
12
+
13
+ expect(token).to eq 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJkYXRhIjoidGVzdCJ9.'
14
+ expect(decoded_token).to eq [
15
+ { 'data' => 'test' },
16
+ { 'typ' => 'JWT', 'alg' => 'none' }
17
+ ]
18
+ end
19
+
20
+ it 'HMAC' do
21
+ token = JWT.encode payload, 'my$ecretK3y', 'HS256'
22
+ decoded_token = JWT.decode token, 'my$ecretK3y', false
23
+
24
+ expect(token).to eq 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoidGVzdCJ9.ZxW8go9hz3ETCSfxFxpwSkYg_602gOPKearsf6DsxgY'
25
+ expect(decoded_token).to eq [
26
+ { 'data' => 'test' },
27
+ { 'typ' => 'JWT', 'alg' => 'HS256' }
28
+ ]
29
+ end
30
+
31
+ it 'RSA' do
32
+ rsa_private = OpenSSL::PKey::RSA.generate 2048
33
+ rsa_public = rsa_private.public_key
34
+
35
+ token = JWT.encode payload, rsa_private, 'RS256'
36
+ decoded_token = JWT.decode token, rsa_public, true, algorithm: 'RS256'
37
+
38
+ expect(decoded_token).to eq [
39
+ { 'data' => 'test' },
40
+ { 'typ' => 'JWT', 'alg' => 'RS256' }
41
+ ]
42
+ end
43
+
44
+ it 'ECDSA' do
45
+ ecdsa_key = OpenSSL::PKey::EC.new 'prime256v1'
46
+ ecdsa_key.generate_key
47
+ ecdsa_public = OpenSSL::PKey::EC.new ecdsa_key
48
+ ecdsa_public.private_key = nil
49
+
50
+ token = JWT.encode payload, ecdsa_key, 'ES256'
51
+ decoded_token = JWT.decode token, ecdsa_public, true, algorithm: 'ES256'
52
+
53
+ expect(decoded_token).to eq [
54
+ { 'data' => 'test' },
55
+ { 'typ' => 'JWT', 'alg' => 'ES256' }
56
+ ]
57
+ end
58
+ end
59
+
60
+ context 'claims' do
61
+ let(:hmac_secret) { 'MyP4ssW0rD' }
62
+
63
+ context 'exp' do
64
+ it 'without leeway' do
65
+ exp = Time.now.to_i + 4 * 3600
66
+ exp_payload = { data: 'data', exp: exp }
67
+
68
+ token = JWT.encode exp_payload, hmac_secret, 'HS256'
69
+
70
+ expect do
71
+ JWT.decode token, hmac_secret, true, algorithm: 'HS256'
72
+ end.not_to raise_error
73
+ end
74
+
75
+ it 'with leeway' do
76
+ exp = Time.now.to_i - 10
77
+ leeway = 30 # seconds
78
+
79
+ exp_payload = { data: 'data', exp: exp }
80
+
81
+ token = JWT.encode exp_payload, hmac_secret, 'HS256'
82
+
83
+ expect do
84
+ JWT.decode token, hmac_secret, true, leeway: leeway, algorithm: 'HS256'
85
+ end.not_to raise_error
86
+ end
87
+ end
88
+
89
+ context 'nbf' do
90
+ it 'without leeway' do
91
+ nbf = Time.now.to_i - 3600
92
+ nbf_payload = { data: 'data', nbf: nbf }
93
+ token = JWT.encode nbf_payload, hmac_secret, 'HS256'
94
+
95
+ expect do
96
+ JWT.decode token, hmac_secret, true, algorithm: 'HS256'
97
+ end.not_to raise_error
98
+ end
99
+
100
+ it 'with leeway' do
101
+ nbf = Time.now.to_i + 10
102
+ leeway = 30
103
+ nbf_payload = { data: 'data', nbf: nbf }
104
+ token = JWT.encode nbf_payload, hmac_secret, 'HS256'
105
+
106
+ expect do
107
+ JWT.decode token, hmac_secret, true, leeway: leeway, algorithm: 'HS256'
108
+ end.not_to raise_error
109
+ end
110
+ end
111
+
112
+ it 'iss' do
113
+ iss = 'My Awesome Company Inc. or https://my.awesome.website/'
114
+ iss_payload = { data: 'data', iss: iss }
115
+
116
+ token = JWT.encode iss_payload, hmac_secret, 'HS256'
117
+
118
+ expect do
119
+ JWT.decode token, hmac_secret, true, iss: iss, algorithm: 'HS256'
120
+ end.not_to raise_error
121
+ end
122
+
123
+ context 'aud' do
124
+ it 'array' do
125
+ aud = %w(Young Old)
126
+ aud_payload = { data: 'data', aud: aud }
127
+
128
+ token = JWT.encode aud_payload, hmac_secret, 'HS256'
129
+
130
+ expect do
131
+ JWT.decode token, hmac_secret, true, aud: %w(Old Young), verify_aud: true, algorithm: 'HS256'
132
+ end.not_to raise_error
133
+ end
134
+
135
+ it 'string' do
136
+ expect do
137
+ end.not_to raise_error
138
+ end
139
+ end
140
+
141
+ it 'jti' do
142
+ iat = Time.now.to_i
143
+ hmac_secret = 'test'
144
+ jti_raw = [hmac_secret, iat].join(':').to_s
145
+ jti = Digest::MD5.hexdigest(jti_raw)
146
+ jti_payload = { data: 'data', iat: iat, jti: jti }
147
+
148
+ token = JWT.encode jti_payload, hmac_secret, 'HS256'
149
+
150
+ expect do
151
+ JWT.decode token, hmac_secret, true, verify_jti: true, algorithm: 'HS256'
152
+ end.not_to raise_error
153
+ end
154
+
155
+ context 'iat' do
156
+ it 'without leeway' do
157
+ iat = Time.now.to_i
158
+ iat_payload = { data: 'data', iat: iat }
159
+
160
+ token = JWT.encode iat_payload, hmac_secret, 'HS256'
161
+
162
+ expect do
163
+ JWT.decode token, hmac_secret, true, verify_iat: true, algorithm: 'HS256'
164
+ end.not_to raise_error
165
+ end
166
+
167
+ it 'with leeway' do
168
+ iat = Time.now.to_i - 7
169
+ iat_payload = { data: 'data', iat: iat, leeway: 10 }
170
+
171
+ token = JWT.encode iat_payload, hmac_secret, 'HS256'
172
+
173
+ expect do
174
+ JWT.decode token, hmac_secret, true, verify_iat: true, algorithm: 'HS256'
175
+ end.not_to raise_error
176
+ end
177
+ end
178
+
179
+ it 'sub' do
180
+ sub = 'Subject'
181
+ sub_payload = { data: 'data', sub: sub }
182
+
183
+ token = JWT.encode sub_payload, hmac_secret, 'HS256'
184
+
185
+ expect do
186
+ JWT.decode token, hmac_secret, true, 'sub' => sub, :verify_sub => true, :algorithm => 'HS256'
187
+ end.not_to raise_error
188
+ end
189
+ end
190
+ end
data/spec/jwt/verify_spec.rb CHANGED
@@ -1,10 +1,11 @@
1
+ # frozen_string_literal: true
1
2
  require 'spec_helper'
2
3
  require 'jwt/verify'
3
4
 
4
5
  module JWT
5
6
  RSpec.describe Verify do
6
7
  let(:base_payload) { { 'user_id' => 'some@user.tld' } }
7
- let(:options) { { leeway: 0} }
8
+ let(:options) { { leeway: 0 } }
8
9
 
9
10
  context '.verify_aud(payload, options)' do
10
11
  let(:scalar_aud) { 'ruby-jwt-audience' }
@@ -60,6 +61,14 @@ module JWT
60
61
  it 'must allow some leeway in the expiration when configured' do
61
62
  Verify.verify_expiration(payload, options.merge(leeway: 10))
62
63
  end
64
+
65
+ it 'must be expired if the exp claim equals the current time' do
66
+ payload['exp'] = Time.now.to_i
67
+
68
+ expect do
69
+ Verify.verify_expiration(payload, options)
70
+ end.to raise_error JWT::ExpiredSignature
71
+ end
63
72
  end
64
73
 
65
74
  context '.verify_iat(payload, options)' do
@@ -135,12 +144,12 @@ module JWT
135
144
 
136
145
  it 'must raise JWT::InvalidJtiError when verify_jti proc returns false' do
137
146
  expect do
138
- Verify.verify_jti(payload, options.merge(verify_jti: ->(jti) { false }))
147
+ Verify.verify_jti(payload, options.merge(verify_jti: ->(_jti) { false }))
139
148
  end.to raise_error JWT::InvalidJtiError, /invalid/i
140
149
  end
141
150
 
142
151
  it 'true proc should not raise JWT::InvalidJtiError' do
143
- Verify.verify_jti(payload, options.merge(verify_jti: ->(jti) { true }))
152
+ Verify.verify_jti(payload, options.merge(verify_jti: ->(_jti) { true }))
144
153
  end
145
154
  end
146
155
 
data/spec/jwt_spec.rb CHANGED
@@ -50,6 +50,14 @@ describe JWT do
50
50
  expect(header['alg']).to eq alg
51
51
  expect(jwt_payload).to eq payload
52
52
  end
53
+
54
+ it 'should display a better error message if payload exp is_a?(Time)' do
55
+ payload['exp'] = Time.now
56
+
57
+ expect do
58
+ JWT.encode payload, nil, alg
59
+ end.to raise_error JWT::InvalidPayload
60
+ end
53
61
  end
54
62
 
55
63
  %w(HS256 HS384 HS512).each do |alg|
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: jwt
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.5.4
4
+ version: 1.5.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Jeff Lindsay
@@ -9,90 +9,104 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2016-03-24 00:00:00.000000000 Z
12
+ date: 2016-09-16 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: bundler
16
16
  requirement: !ruby/object:Gem::Requirement
17
17
  requirements:
18
- - - ! '>='
18
+ - - ">="
19
19
  - !ruby/object:Gem::Version
20
20
  version: '0'
21
21
  type: :development
22
22
  prerelease: false
23
23
  version_requirements: !ruby/object:Gem::Requirement
24
24
  requirements:
25
- - - ! '>='
25
+ - - ">="
26
26
  - !ruby/object:Gem::Version
27
27
  version: '0'
28
28
  - !ruby/object:Gem::Dependency
29
29
  name: rake
30
30
  requirement: !ruby/object:Gem::Requirement
31
31
  requirements:
32
- - - ! '>='
32
+ - - ">="
33
33
  - !ruby/object:Gem::Version
34
34
  version: '0'
35
35
  type: :development
36
36
  prerelease: false
37
37
  version_requirements: !ruby/object:Gem::Requirement
38
38
  requirements:
39
- - - ! '>='
39
+ - - ">="
40
40
  - !ruby/object:Gem::Version
41
41
  version: '0'
42
+ - !ruby/object:Gem::Dependency
43
+ name: json
44
+ requirement: !ruby/object:Gem::Requirement
45
+ requirements:
46
+ - - "<"
47
+ - !ruby/object:Gem::Version
48
+ version: '2.0'
49
+ type: :development
50
+ prerelease: false
51
+ version_requirements: !ruby/object:Gem::Requirement
52
+ requirements:
53
+ - - "<"
54
+ - !ruby/object:Gem::Version
55
+ version: '2.0'
42
56
  - !ruby/object:Gem::Dependency
43
57
  name: rspec
44
58
  requirement: !ruby/object:Gem::Requirement
45
59
  requirements:
46
- - - ! '>='
60
+ - - ">="
47
61
  - !ruby/object:Gem::Version
48
62
  version: '0'
49
63
  type: :development
50
64
  prerelease: false
51
65
  version_requirements: !ruby/object:Gem::Requirement
52
66
  requirements:
53
- - - ! '>='
67
+ - - ">="
54
68
  - !ruby/object:Gem::Version
55
69
  version: '0'
56
70
  - !ruby/object:Gem::Dependency
57
71
  name: simplecov
58
72
  requirement: !ruby/object:Gem::Requirement
59
73
  requirements:
60
- - - ! '>='
74
+ - - ">="
61
75
  - !ruby/object:Gem::Version
62
76
  version: '0'
63
77
  type: :development
64
78
  prerelease: false
65
79
  version_requirements: !ruby/object:Gem::Requirement
66
80
  requirements:
67
- - - ! '>='
81
+ - - ">="
68
82
  - !ruby/object:Gem::Version
69
83
  version: '0'
70
84
  - !ruby/object:Gem::Dependency
71
85
  name: simplecov-json
72
86
  requirement: !ruby/object:Gem::Requirement
73
87
  requirements:
74
- - - ! '>='
88
+ - - ">="
75
89
  - !ruby/object:Gem::Version
76
90
  version: '0'
77
91
  type: :development
78
92
  prerelease: false
79
93
  version_requirements: !ruby/object:Gem::Requirement
80
94
  requirements:
81
- - - ! '>='
95
+ - - ">="
82
96
  - !ruby/object:Gem::Version
83
97
  version: '0'
84
98
  - !ruby/object:Gem::Dependency
85
99
  name: codeclimate-test-reporter
86
100
  requirement: !ruby/object:Gem::Requirement
87
101
  requirements:
88
- - - ! '>='
102
+ - - ">="
89
103
  - !ruby/object:Gem::Version
90
104
  version: '0'
91
105
  type: :development
92
106
  prerelease: false
93
107
  version_requirements: !ruby/object:Gem::Requirement
94
108
  requirements:
95
- - - ! '>='
109
+ - - ">="
96
110
  - !ruby/object:Gem::Version
97
111
  version: '0'
98
112
  description: A pure ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT)
@@ -102,11 +116,12 @@ executables: []
102
116
  extensions: []
103
117
  extra_rdoc_files: []
104
118
  files:
105
- - .codeclimate.yml
106
- - .gitignore
107
- - .rspec
108
- - .rubocop.yml
109
- - .travis.yml
119
+ - ".codeclimate.yml"
120
+ - ".gitignore"
121
+ - ".rspec"
122
+ - ".rubocop.yml"
123
+ - ".travis.yml"
124
+ - CHANGELOG.md
110
125
  - Gemfile
111
126
  - LICENSE
112
127
  - Manifest
@@ -139,6 +154,7 @@ files:
139
154
  - spec/fixtures/certs/rsa-2048-wrong-public.pem
140
155
  - spec/fixtures/certs/rsa-4096-private.pem
141
156
  - spec/fixtures/certs/rsa-4096-public.pem
157
+ - spec/integration/readme_examples_spec.rb
142
158
  - spec/jwt/verify_spec.rb
143
159
  - spec/jwt_spec.rb
144
160
  - spec/spec_helper.rb
@@ -152,17 +168,17 @@ require_paths:
152
168
  - lib
153
169
  required_ruby_version: !ruby/object:Gem::Requirement
154
170
  requirements:
155
- - - ! '>='
171
+ - - ">="
156
172
  - !ruby/object:Gem::Version
157
173
  version: '0'
158
174
  required_rubygems_version: !ruby/object:Gem::Requirement
159
175
  requirements:
160
- - - ! '>='
176
+ - - ">="
161
177
  - !ruby/object:Gem::Version
162
178
  version: '0'
163
179
  requirements: []
164
180
  rubyforge_project:
165
- rubygems_version: 2.5.2
181
+ rubygems_version: 2.6.6
166
182
  signing_key:
167
183
  specification_version: 4
168
184
  summary: JSON Web Token implementation in Ruby
@@ -187,6 +203,7 @@ test_files:
187
203
  - spec/fixtures/certs/rsa-2048-wrong-public.pem
188
204
  - spec/fixtures/certs/rsa-4096-private.pem
189
205
  - spec/fixtures/certs/rsa-4096-public.pem
206
+ - spec/integration/readme_examples_spec.rb
190
207
  - spec/jwt/verify_spec.rb
191
208
  - spec/jwt_spec.rb
192
209
  - spec/spec_helper.rb