jwt_signed_request 2.1.3 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: a0e53cf237dc90239e067304c6d19b915876406a
-  data.tar.gz: 8947ddeb892b55b07d62f30a74c2c3c9da113f03
+SHA256:
+  metadata.gz: e3c77d8fa516ef20dd47873584e1533ce01ccda49d0486825177f53e74d165b0
+  data.tar.gz: f54b28aaebb16861a13d129541a2e75a5260d6f19c58c757670952bb3568f8f8
 SHA512:
-  metadata.gz: 1eae234dd7fe4926294543dfb8275cc108addd326056549c5d6197acf802fcdda1976ce91e69d6dee55cf4efc6ca96852f2d1a61f5ce2e3da795d3f7282f3127
-  data.tar.gz: 2729d396489255fedd6e75369a95deec8e064c390d346b3355d783dd37da2ae80adc847762d744297eac4cd228993a95229cd0cc51f71d975011f49eab6b6179
+  metadata.gz: f862b757d5387bcf0ec6f71af7d80b77a8e9d5d906e6957abea7f891c2e452c4a27cac096170f44c24798291feb62d03166f943487044999948d815358f3d1fc
+  data.tar.gz: e67c0b8346883be09a595f2038de8c0e10400230c2cb90d209c66f1a15a9b6c53282cbf28c19c00e84599bbde8787396d319594c163f9acd93f16df833a3f4fd

data/README.md

@@ -190,7 +190,7 @@ Many thanks to the following contributors to this gem:
 - Odin Dutton - [@twe4ked](https://github.com/twe4ked)
 - Sebastian von Conrad - [@vonconrad](https://github.com/vonconrad)
 - Zubin Henner- [@zubin](https://github.com/zubin)
-- Glen Tweedie - [@nocache](https://github.com/nocache)
+- Glenn Tweedie - [@nocache](https://github.com/nocache)
 - Giancarlo Salamanca - [@salamagd](https://github.com/salamagd)
 - Ben Axnick - [@bentheax](https://github.com/bentheax)
 - Glen Stampoultzis - [@gstamp](https://github.com/gstamp)

data/lib/jwt_signed_request/errors.rb

@@ -0,0 +1,16 @@
+module JWTSignedRequest
+  UnauthorizedRequestError = Class.new(StandardError)
+  MissingAuthorizationHeaderError = Class.new(UnauthorizedRequestError)
+  JWTDecodeError = Class.new(UnauthorizedRequestError)
+
+  RequestVerificationFailedError = Class.new(UnauthorizedRequestError)
+  RequestBodyVerificationFailedError = Class.new(RequestVerificationFailedError)
+  RequestHeaderVerificationFailedError = Class.new(RequestVerificationFailedError)
+  RequestMethodVerificationFailedError = Class.new(RequestVerificationFailedError)
+  RequestPathVerificationFailedError = Class.new(RequestVerificationFailedError)
+  RequestQueryVerificationFailedError = Class.new(RequestVerificationFailedError)
+
+  MissingKeyIdError = Class.new(UnauthorizedRequestError)
+  UnknownKeyIdError = Class.new(UnauthorizedRequestError)
+  AlgorithmMismatchError = Class.new(UnauthorizedRequestError)
+end

data/lib/jwt_signed_request/verify.rb

@@ -1,4 +1,5 @@
 require 'jwt_signed_request/headers'
+require 'jwt_signed_request/errors'
 
 module JWTSignedRequest
   class Verify
@@ -20,9 +21,7 @@ module JWTSignedRequest
         raise MissingAuthorizationHeaderError, "Missing Authorization header in the request"
       end
 
-      unless verified_request?
-        raise RequestVerificationFailedError, "Request failed verification"
-      end
+      verify_request!
     end
 
     private
@@ -68,11 +67,28 @@ module JWTSignedRequest
       end
     end
 
-    def verified_request?
-      claims['method'].to_s.downcase == request.request_method.downcase &&
-        claims['path'] == request.fullpath &&
-        claims['body_sha'] == Digest::SHA256.hexdigest(request_body) &&
-        verified_headers?
+    def verify_request!
+      unless request.request_method.casecmp(claims['method'].to_s) == 0
+        raise RequestMethodVerificationFailedError,
+          "Request failed method verification.\nexpected:#{claims['method']}\nreceived:#{request.request_method}"
+      end
+      unless parsed_claims_uri.path == request.path
+        raise RequestPathVerificationFailedError,
+          "Request failed path verification.\nexpected:#{parsed_claims_uri.path}\nreceived:#{request.path}"
+      end
+      unless claims_query_values == request_query_values
+        raise RequestQueryVerificationFailedError,
+          "Request failed query string verification.\nexpected:#{claims_query_values}\nreceived:#{request_query_values}"
+      end
+      unless claims['body_sha'] == Digest::SHA256.hexdigest(request_body)
+        raise RequestBodyVerificationFailedError,
+          "Request failed body verification.\nexpected:#{claims['body_sha']}\
+          received:#{Digest::SHA256.hexdigest(request_body)}"
+      end
+      unless verified_headers?
+        raise RequestHeaderVerificationFailedError,
+          "Request failed header verification.\nexpected:#{claims['headers']}"
+      end
     end
 
     def request_body
@@ -92,5 +108,21 @@ module JWTSignedRequest
         Headers.fetch(header_key, request) == header_value
       end
     end
+
+    def parsed_claims_uri
+      @parsed_claims_uri ||= URI.parse(claims['path'])
+    end
+
+    def standard_query_values(path)
+      URI.decode_www_form(path.query).sort if path && path.query
+    end
+
+    def claims_query_values
+      standard_query_values(parsed_claims_uri)
+    end
+
+    def request_query_values
+      standard_query_values(URI.parse(request.fullpath))
+    end
   end
 end

data/lib/jwt_signed_request/version.rb

@@ -1,3 +1,3 @@
 module JWTSignedRequest
-  VERSION = "2.1.3".freeze
+  VERSION = "2.2.0".freeze
 end

data/lib/jwt_signed_request.rb

@@ -2,6 +2,7 @@ require 'jwt'
 require 'jwt_signed_request/key_store'
 require 'jwt_signed_request/sign'
 require 'jwt_signed_request/verify'
+require 'jwt_signed_request/errors'
 
 module JWTSignedRequest
   extend self
@@ -9,14 +10,6 @@ module JWTSignedRequest
   DEFAULT_ALGORITHM = 'ES256'.freeze
   EMPTY_BODY = "".freeze
 
-  UnauthorizedRequestError = Class.new(StandardError)
-  MissingAuthorizationHeaderError = Class.new(UnauthorizedRequestError)
-  JWTDecodeError = Class.new(UnauthorizedRequestError)
-  RequestVerificationFailedError = Class.new(UnauthorizedRequestError)
-  MissingKeyIdError = Class.new(UnauthorizedRequestError)
-  UnknownKeyIdError = Class.new(UnauthorizedRequestError)
-  AlgorithmMismatchError = Class.new(UnauthorizedRequestError)
-
   def configure_keys
     yield(key_store)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_signed_request
 version: !ruby/object:Gem::Version
-  version: 2.1.3
+  version: 2.2.0
 platform: ruby
 authors:
 - Envato
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-18 00:00:00.000000000 Z
+date: 2018-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -118,6 +118,7 @@ files:
 - README.md
 - lib/jwt_signed_request.rb
 - lib/jwt_signed_request/claims.rb
+- lib/jwt_signed_request/errors.rb
 - lib/jwt_signed_request/headers.rb
 - lib/jwt_signed_request/key_store.rb
 - lib/jwt_signed_request/middlewares/faraday.rb
@@ -144,7 +145,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.13
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: JWT request signing and verification for Internal APIs