jwt_auth_cognito 1.0.0.pre.beta.8 → 1.0.0.pre.beta.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 890178b5dabf5d60fd718020edb4b3a53c7beb031edcbfe4530b2075643235d1
-  data.tar.gz: 0561a4d505653838b1a876ac2c09b96e149302b562c8ea7b0838a295770ad302
+  metadata.gz: 97be07f0c6be821ad157fcf5c6b7a173fc6866145d2b738481aaa3b912c39703
+  data.tar.gz: 28f5119547d00881a8ccb84be5ca584cf81394a4ba1ce86cf1d5306855037f15
 SHA512:
-  metadata.gz: fd88dbfd8f4bba8480b7f9bc0fd8e277dc2c01c21ba4ada2a1011fc6080c2886cd78ebd00040382f04d9b80cc40e01754a24d0779417cdf94ec0c824cc7e8ceb
-  data.tar.gz: 6f96b767c1281c5be52be7a9c7911fc05e692b1fb48107ee96cbc2c3c659e819d5aaad4e1dded17e5f9d0c9aae201839cd3f7005ee43d1cff8fe7af0cd7ee37c
+  metadata.gz: e0d17203f3fdba6311fd43d56a451f4e454015f37ab91c7f1231ac334d2c8fb92b2c6fc05b08d109acd0386b3754fec1be1cc5b4bb5ae7e15e4483d9527f9d38
+  data.tar.gz: cc89ebd874a97fdac6fd6fe9c417d9e53f41658aab723a47e4df0c3551fe64dc447c507035d8daa42696a29f342a60d8c4a7987a5f880dd589d5ad41e8414805

data/CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0-beta.10] - 2025-01-23
+
+### Fixed
+
+- **Audience Validation**: Fixed overly strict audience validation for AWS Cognito access tokens
+  - Access tokens from Cognito typically don't include 'aud' claim, only ID tokens do
+  - Modified JWKS validation to only enforce audience checking for ID tokens (`token_use: 'id'`)
+  - Access tokens (`token_use: 'access'`) now skip audience validation as per AWS Cognito standards
+  - Resolves "Invalid audience. Expected [client_id], received <none>" error for access tokens
+  - Maintains proper security validation for ID tokens
+
+### Improved
+
+- **JWT Standards Compliance**: Enhanced compatibility with AWS Cognito token specifications
+  - Pre-decodes tokens to determine type before applying validation rules
+  - Follows AWS Cognito best practices for token type-specific validation
+  - Maintains backward compatibility with existing ID token validation
+
+## [1.0.0-beta.9] - 2025-01-22
+
+### Fixed
+
+- **JWKS OpenSSL Compatibility**: Complete reimplementation of JWK handling to eliminate OpenSSL version compatibility issues
+  - Replaced manual JWK to PEM conversion with JWT gem's native JWK support
+  - Removed complex OpenSSL version-specific fallback logic (40+ lines → 8 lines)
+  - Eliminates "undefined method 'n=' for OpenSSL::PKey::RSA" and "set_key= is incompatible with OpenSSL 3.0" errors
+  - Uses `JWT::JWK.import()` for robust, library-managed key conversion
+  - Aligned approach with Node.js jwt-auth-package implementation for consistency
+
+- **TLS Configuration**: Removed problematic TLS versioning from Redis SSL configuration
+  - Eliminated redis_tls_min_version and redis_tls_max_version parameters
+  - Simplified SSL configuration to focus on certificate validation and verify mode
+  - Resolves "unrecognized version TLSv1_2" errors
+  - Maintains backward compatibility with existing Redis SSL setups
+
+### Improved
+
+- **Code Quality**: Significantly simplified and more maintainable JWKS implementation
+  - Reduced complexity and eliminated OpenSSL version-specific code paths
+  - Better error handling with specific JWT::JWKError exceptions
+  - Enhanced reliability by leveraging well-tested JWT gem capabilities
+  - All tests passing (74 examples, 0 failures)
+  - RuboCop compliant with no style violations
+
 ## [1.0.0-beta.6] - 2025-01-22
 
 ### Fixed

data/CLAUDE.md

@@ -304,7 +304,7 @@ JWKS_CACHE_TTL=3600  # 1 hour
 
 ## Version Compatibility
 
-### ✅ **Updated January 2025 - Version 1.0.0-beta.6**
+### ✅ **Updated January 2025 - Version 1.0.0-beta.10**
 
 **Stable production-ready beta with complete pipeline compatibility**
 

data/README.md

@@ -5,7 +5,7 @@ Una gema Ruby para validar tokens JWT de AWS Cognito de forma offline con funcio
 ## Características
 
 - **Validación JWT Offline**: Valida tokens JWT de Cognito sin llamar a las APIs de AWS
-- **Soporte JWKS**: Recuperación automática y cache de claves públicas desde el endpoint JWKS de Cognito
+- **Soporte JWKS**: Recuperación automática y cache de claves públicas desde el endpoint JWKS de Cognito con compatibilidad total OpenSSL
 - **Blacklist de Tokens**: Gestión de revocación y blacklist de tokens basada en Redis con soporte TLS completo
 - **Configuración Flexible**: Soporte para modos de validación seguro (producción) y básico (desarrollo)
 - **Gestión de Tokens de Usuario**: Rastrear e invalidar todos los tokens de un usuario específico
@@ -53,9 +53,7 @@ JwtAuthCognito.configure do |config|
   config.redis_ssl = true
   config.redis_ca_cert_path = 'redis'      # AWS SSM path
   config.redis_ca_cert_name = 'ca-cert'    # AWS SSM parameter name
-  config.redis_tls_min_version = 'TLSv1.2'
-  config.redis_tls_max_version = 'TLSv1.3'
-  config.redis_verify_mode = 'peer'
+  config.redis_verify_mode = 'peer'        # 'peer' para validación estricta, 'none' para desarrollo
   
   # Opcional: Configuraciones de cache y validación
   config.jwks_cache_ttl = 3600 # 1 hora
@@ -88,9 +86,7 @@ REDIS_TLS=true
 # Configuración TLS de Redis (compatible con auth-service)
 REDIS_CA_CERT_PATH=redis        # Para AWS SSM (path del parámetro)
 REDIS_CA_CERT_NAME=ca-cert      # Para AWS SSM (nombre del parámetro)
-REDIS_TLS_MIN_VERSION=TLSv1_2
-REDIS_TLS_MAX_VERSION=TLSv1_3
-REDIS_VERIFY_MODE=peer
+REDIS_VERIFY_MODE=peer          # 'peer' para validación estricta, 'none' para desarrollo
 
 # Configuración de cache
 JWKS_CACHE_TTL=3600

data/lib/jwt_auth_cognito/jwks_service.rb

@@ -23,6 +23,13 @@ module JwtAuthCognito
       raise ValidationError, 'Token missing key ID (kid)' unless kid
 
       public_key = get_public_key(kid)
+      # First decode to check token type before audience validation
+      payload_preview = JWT.decode(token, nil, false).first
+
+      # Only verify audience for ID tokens, not access tokens
+      # Access tokens from Cognito might not have 'aud' claim
+      should_verify_aud = @config.cognito_client_id && payload_preview['token_use'] == 'id'
+
       decoded_token = JWT.decode(
         token,
         public_key,
@@ -31,8 +38,8 @@ module JwtAuthCognito
           algorithm: 'RS256',
           iss: @config.cognito_issuer,
           verify_iss: true,
-          aud: @config.cognito_client_id,
-          verify_aud: @config.cognito_client_id ? true : false
+          aud: should_verify_aud ? @config.cognito_client_id : nil,
+          verify_aud: should_verify_aud
         }
       )
 
@@ -66,8 +73,8 @@ module JwtAuthCognito
 
       raise ValidationError, 'Key ID not found in JWKS' unless key_data
 
-      # Convert JWK to PEM
-      public_key = jwk_to_pem(key_data)
+      # Convert JWK to key using JWT gem's native support
+      public_key = jwk_to_key(key_data)
 
       # Cache the key
       @cache[kid] = public_key
@@ -93,33 +100,16 @@ module JwtAuthCognito
       raise ValidationError, "Failed to fetch JWKS: #{e.message}"
     end
 
-    def jwk_to_pem(key_data)
-      # Convert JWK RSA key to PEM format
-      n = base64url_decode(key_data['n'])
-      e = base64url_decode(key_data['e'])
-
-      # Create RSA key using method compatible with OpenSSL 3.0+
-      n_bn = OpenSSL::BN.new(n, 2)
-      e_bn = OpenSSL::BN.new(e, 2)
-
-      # Use the new constructor that accepts modulus and exponent
-      key = OpenSSL::PKey::RSA.new
-
-      # For OpenSSL 3.0+ compatibility, use set_key method if available
-      if key.respond_to?(:set_key)
-        key.set_key(n_bn, e_bn, nil)
-      else
-        # Fallback for older OpenSSL versions
-        key.n = n_bn
-        key.e = e_bn
-      end
-
-      key
-    end
+    def jwk_to_key(key_data)
+      # Use JWT gem's native JWK support instead of manual OpenSSL conversion
+      # This eliminates OpenSSL version compatibility issues
 
-    def base64url_decode(str)
-      str += '=' * (4 - str.length.modulo(4))
-      Base64.decode64(str.tr('-_', '+/'))
+      jwk = JWT::JWK.import(key_data)
+      jwk.keypair
+    rescue JWT::JWKError => e
+      raise ValidationError, "Invalid JWK format: #{e.message}"
+    rescue StandardError => e
+      raise ValidationError, "Failed to convert JWK to key: #{e.message}"
     end
 
     def cache_valid?(kid)

data/lib/jwt_auth_cognito/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JwtAuthCognito
-  VERSION = '1.0.0-beta.8'
+  VERSION = '1.0.0-beta.10'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_auth_cognito
 version: !ruby/object:Gem::Version
-  version: 1.0.0.pre.beta.8
+  version: 1.0.0.pre.beta.10
 platform: ruby
 authors:
 - The Optimal
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-09-22 00:00:00.000000000 Z
+date: 2025-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ssm