jwtb 2.0.0.beta2.bsk1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (46) hide show
  1. checksums.yaml +7 -0
  2. data/.codeclimate.yml +20 -0
  3. data/.gitignore +11 -0
  4. data/.rspec +1 -0
  5. data/.rubocop.yml +5 -0
  6. data/.travis.yml +13 -0
  7. data/CHANGELOG.md +411 -0
  8. data/Gemfile +4 -0
  9. data/LICENSE +7 -0
  10. data/Manifest +8 -0
  11. data/README.md +443 -0
  12. data/Rakefile +11 -0
  13. data/jwtb.gemspec +31 -0
  14. data/lib/jwtb.rb +67 -0
  15. data/lib/jwtb/decode.rb +45 -0
  16. data/lib/jwtb/default_options.rb +14 -0
  17. data/lib/jwtb/encode.rb +51 -0
  18. data/lib/jwtb/error.rb +15 -0
  19. data/lib/jwtb/signature.rb +146 -0
  20. data/lib/jwtb/verify.rb +84 -0
  21. data/lib/jwtb/version.rb +24 -0
  22. data/spec/fixtures/certs/ec256-private.pem +8 -0
  23. data/spec/fixtures/certs/ec256-public.pem +4 -0
  24. data/spec/fixtures/certs/ec256-wrong-private.pem +8 -0
  25. data/spec/fixtures/certs/ec256-wrong-public.pem +4 -0
  26. data/spec/fixtures/certs/ec384-private.pem +9 -0
  27. data/spec/fixtures/certs/ec384-public.pem +5 -0
  28. data/spec/fixtures/certs/ec384-wrong-private.pem +9 -0
  29. data/spec/fixtures/certs/ec384-wrong-public.pem +5 -0
  30. data/spec/fixtures/certs/ec512-private.pem +10 -0
  31. data/spec/fixtures/certs/ec512-public.pem +6 -0
  32. data/spec/fixtures/certs/ec512-wrong-private.pem +10 -0
  33. data/spec/fixtures/certs/ec512-wrong-public.pem +6 -0
  34. data/spec/fixtures/certs/rsa-1024-private.pem +15 -0
  35. data/spec/fixtures/certs/rsa-1024-public.pem +6 -0
  36. data/spec/fixtures/certs/rsa-2048-private.pem +27 -0
  37. data/spec/fixtures/certs/rsa-2048-public.pem +9 -0
  38. data/spec/fixtures/certs/rsa-2048-wrong-private.pem +27 -0
  39. data/spec/fixtures/certs/rsa-2048-wrong-public.pem +9 -0
  40. data/spec/fixtures/certs/rsa-4096-private.pem +51 -0
  41. data/spec/fixtures/certs/rsa-4096-public.pem +14 -0
  42. data/spec/integration/readme_examples_spec.rb +216 -0
  43. data/spec/jwtb/verify_spec.rb +190 -0
  44. data/spec/jwtb_spec.rb +233 -0
  45. data/spec/spec_helper.rb +28 -0
  46. metadata +225 -0
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA1:
3
+ metadata.gz: 54a8431de0f02f364040f7d70bc6c8d57e5130c3
4
+ data.tar.gz: 81b742260d140f646fa30fc9d356ac8de9e29fb4
5
+ SHA512:
6
+ metadata.gz: 427a7eb461e1e197f64f9d202becabca823d74cdfed4c25a078a559b54666aeed02024211d6c668b4f6c37faa122b83112c5f83bb0a8cff66c54a4038af2173d
7
+ data.tar.gz: dabe722ba8a97f3f6f8950ee31eb5bc64289d32a516236ca60b401c6b7f7f82801b741c451fed66c4fbf0bf366b89df349f6d7c54bedf2c61ed1ca0ebd95d7c2
@@ -0,0 +1,20 @@
1
+ engines:
2
+ rubocop:
3
+ enabled: true
4
+ golint:
5
+ enabled: false
6
+ gofmt:
7
+ enabled: false
8
+ eslint:
9
+ enabled: false
10
+ csslint:
11
+ enabled: false
12
+
13
+ ratings:
14
+ paths:
15
+ - lib/**
16
+ - "**.rb"
17
+
18
+ exclude_paths:
19
+ - spec/**/*
20
+ - vendor/**/*
@@ -0,0 +1,11 @@
1
+ .idea/
2
+ jwt.gemspec
3
+ pkg
4
+ Gemfile.lock
5
+ coverage/
6
+ .DS_Store
7
+ .rbenv-gemsets
8
+ .ruby-version
9
+ .vscode/
10
+ .bundle
11
+ bin/
data/.rspec ADDED
@@ -0,0 +1 @@
1
+ --color
@@ -0,0 +1,5 @@
1
+ AllCops:
2
+ Excludes:
3
+ - spec/**/*
4
+ Metrics/LineLength:
5
+ Enabled: false
@@ -0,0 +1,13 @@
1
+ sudo: required
2
+ cache: bundler
3
+ language: ruby
4
+ rvm:
5
+ - 2.2.0
6
+ - 2.3.0
7
+ - 2.4.0
8
+ script: "bundle exec rspec && bundle exec codeclimate-test-reporter"
9
+ before_install:
10
+ - sudo add-apt-repository ppa:chris-lea/libsodium -y
11
+ - sudo apt-get update -q
12
+ - sudo apt-get install libsodium-dev -y
13
+ - gem install bundler
@@ -0,0 +1,411 @@
1
+ # Change Log
2
+
3
+ ## [v2.0.0](https://github.com/jwt/ruby-jwt/tree/v2.0.0) (2017-02-27)
4
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.6...v2.0.0)
5
+
6
+ **Implemented enhancements:**
7
+
8
+ - Error with method sign for String [\#171](https://github.com/jwt/ruby-jwt/issues/171)
9
+ - Refactor the encondig code [\#121](https://github.com/jwt/ruby-jwt/issues/121)
10
+ - Refactor [\#196](https://github.com/jwt/ruby-jwt/pull/196) ([EmilioCristalli](https://github.com/EmilioCristalli))
11
+ - Move signature logic to its own module [\#195](https://github.com/jwt/ruby-jwt/pull/195) ([EmilioCristalli](https://github.com/EmilioCristalli))
12
+ - Add options for claim-specific leeway [\#187](https://github.com/jwt/ruby-jwt/pull/187) ([EmilioCristalli](https://github.com/EmilioCristalli))
13
+ - Add user friendly encode error if private key is a String, \#171 [\#176](https://github.com/jwt/ruby-jwt/pull/176) ([xamenrax](https://github.com/xamenrax))
14
+ - Return empty string if signature less than byte\_size \#155 [\#175](https://github.com/jwt/ruby-jwt/pull/175) ([xamenrax](https://github.com/xamenrax))
15
+ - Remove 'typ' optional parameter [\#174](https://github.com/jwt/ruby-jwt/pull/174) ([xamenrax](https://github.com/xamenrax))
16
+ - Pass payload to keyfinder [\#172](https://github.com/jwt/ruby-jwt/pull/172) ([CodeMonkeySteve](https://github.com/CodeMonkeySteve))
17
+ - Use RbNaCl for HMAC if available with fallback to OpenSSL [\#149](https://github.com/jwt/ruby-jwt/pull/149) ([mwpastore](https://github.com/mwpastore))
18
+
19
+ **Fixed bugs:**
20
+
21
+ - ruby-jwt::raw\_to\_asn1: Fails for signatures less than byte\_size [\#155](https://github.com/jwt/ruby-jwt/issues/155)
22
+ - The leeway parameter is applies to all time based verifications [\#129](https://github.com/jwt/ruby-jwt/issues/129)
23
+ - Add options for claim-specific leeway [\#187](https://github.com/jwt/ruby-jwt/pull/187) ([EmilioCristalli](https://github.com/EmilioCristalli))
24
+ - Make algorithm option required to verify signature [\#184](https://github.com/jwt/ruby-jwt/pull/184) ([EmilioCristalli](https://github.com/EmilioCristalli))
25
+ - Validate audience when payload is a scalar and options is an array [\#183](https://github.com/jwt/ruby-jwt/pull/183) ([steti](https://github.com/steti))
26
+
27
+ **Closed issues:**
28
+
29
+ - Different encoded value between servers with same password [\#197](https://github.com/jwt/ruby-jwt/issues/197)
30
+ - Signature is different at each run [\#190](https://github.com/jwt/ruby-jwt/issues/190)
31
+ - Include custom headers with password [\#189](https://github.com/jwt/ruby-jwt/issues/189)
32
+ - can't create token - 'NotImplementedError: Unsupported signing method' [\#186](https://github.com/jwt/ruby-jwt/issues/186)
33
+ - Why jwt depends on json \< 2.0 ? [\#179](https://github.com/jwt/ruby-jwt/issues/179)
34
+ - Cannot verify JWT at all?? [\#177](https://github.com/jwt/ruby-jwt/issues/177)
35
+ - verify\_iss: true is raising JWT::DecodeError instead of JWT::InvalidIssuerError [\#170](https://github.com/jwt/ruby-jwt/issues/170)
36
+
37
+ **Merged pull requests:**
38
+
39
+ - Add Codacy coverage reporter [\#194](https://github.com/jwt/ruby-jwt/pull/194) ([excpt](https://github.com/excpt))
40
+ - Add minimum required ruby version to gemspec [\#193](https://github.com/jwt/ruby-jwt/pull/193) ([excpt](https://github.com/excpt))
41
+ - Code smell fixes [\#192](https://github.com/jwt/ruby-jwt/pull/192) ([excpt](https://github.com/excpt))
42
+ - Version bump to 2.0.0.dev [\#191](https://github.com/jwt/ruby-jwt/pull/191) ([excpt](https://github.com/excpt))
43
+ - Basic encode module refactoring \#121 [\#182](https://github.com/jwt/ruby-jwt/pull/182) ([xamenrax](https://github.com/xamenrax))
44
+ - Fix travis ci build configuration [\#181](https://github.com/jwt/ruby-jwt/pull/181) ([excpt](https://github.com/excpt))
45
+ - Fix travis ci build configuration [\#180](https://github.com/jwt/ruby-jwt/pull/180) ([excpt](https://github.com/excpt))
46
+ - Fix typo in README [\#178](https://github.com/jwt/ruby-jwt/pull/178) ([tomeduarte](https://github.com/tomeduarte))
47
+ - Fix code style [\#173](https://github.com/jwt/ruby-jwt/pull/173) ([excpt](https://github.com/excpt))
48
+ - Fixed a typo in a spec name [\#169](https://github.com/jwt/ruby-jwt/pull/169) ([Mingan](https://github.com/Mingan))
49
+
50
+ ## [v1.5.6](https://github.com/jwt/ruby-jwt/tree/v1.5.6) (2016-09-19)
51
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.5...v1.5.6)
52
+
53
+ **Fixed bugs:**
54
+
55
+ - Fix missing symbol handling in aud verify code [\#166](https://github.com/jwt/ruby-jwt/pull/166) ([excpt](https://github.com/excpt))
56
+
57
+ **Merged pull requests:**
58
+
59
+ - Update changelog [\#168](https://github.com/jwt/ruby-jwt/pull/168) ([excpt](https://github.com/excpt))
60
+ - Fix rubocop code smells [\#167](https://github.com/jwt/ruby-jwt/pull/167) ([excpt](https://github.com/excpt))
61
+
62
+ ## [v1.5.5](https://github.com/jwt/ruby-jwt/tree/v1.5.5) (2016-09-16)
63
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.4...v1.5.5)
64
+
65
+ **Implemented enhancements:**
66
+
67
+ - JWT.decode always raises JWT::ExpiredSignature for tokens created with Time objects passed as the `exp` parameter [\#148](https://github.com/jwt/ruby-jwt/issues/148)
68
+
69
+ **Fixed bugs:**
70
+
71
+ - expiration check does not give "Signature has expired" error for the exact time of expiration [\#157](https://github.com/jwt/ruby-jwt/issues/157)
72
+ - JTI claim broken? [\#152](https://github.com/jwt/ruby-jwt/issues/152)
73
+ - Audience Claim broken? [\#151](https://github.com/jwt/ruby-jwt/issues/151)
74
+ - 1.5.3 breaks compatibility with 1.5.2 [\#133](https://github.com/jwt/ruby-jwt/issues/133)
75
+ - Version 1.5.3 breaks 1.9.3 compatibility, but not documented as such [\#132](https://github.com/jwt/ruby-jwt/issues/132)
76
+ - Fix: exp claim check [\#161](https://github.com/jwt/ruby-jwt/pull/161) ([excpt](https://github.com/excpt))
77
+
78
+ **Closed issues:**
79
+
80
+ - Rendering Json Results in JWT::DecodeError [\#162](https://github.com/jwt/ruby-jwt/issues/162)
81
+ - PHP Libraries [\#154](https://github.com/jwt/ruby-jwt/issues/154)
82
+ - \[security\] Signature verified after expiration/sub/iss checks [\#153](https://github.com/jwt/ruby-jwt/issues/153)
83
+ - Is ruby-jwt thread-safe? [\#150](https://github.com/jwt/ruby-jwt/issues/150)
84
+ - JWT 1.5.3 [\#143](https://github.com/jwt/ruby-jwt/issues/143)
85
+ - gem install v 1.5.3 returns error [\#141](https://github.com/jwt/ruby-jwt/issues/141)
86
+ - Adding a CHANGELOG [\#140](https://github.com/jwt/ruby-jwt/issues/140)
87
+
88
+ **Merged pull requests:**
89
+
90
+ - Bump version [\#165](https://github.com/jwt/ruby-jwt/pull/165) ([excpt](https://github.com/excpt))
91
+ - Improve error message for exp claim in payload [\#164](https://github.com/jwt/ruby-jwt/pull/164) ([excpt](https://github.com/excpt))
92
+ - Fix \#151 and code refactoring [\#163](https://github.com/jwt/ruby-jwt/pull/163) ([excpt](https://github.com/excpt))
93
+ - Signature validation before claim verification [\#160](https://github.com/jwt/ruby-jwt/pull/160) ([excpt](https://github.com/excpt))
94
+ - Create specs for README.md examples [\#159](https://github.com/jwt/ruby-jwt/pull/159) ([excpt](https://github.com/excpt))
95
+ - Tiny Readme Improvement [\#156](https://github.com/jwt/ruby-jwt/pull/156) ([b264](https://github.com/b264))
96
+ - Added test execution to Rakefile [\#147](https://github.com/jwt/ruby-jwt/pull/147) ([jabbrwcky](https://github.com/jabbrwcky))
97
+ - Add more bling bling to the site [\#146](https://github.com/jwt/ruby-jwt/pull/146) ([excpt](https://github.com/excpt))
98
+ - Bump version [\#145](https://github.com/jwt/ruby-jwt/pull/145) ([excpt](https://github.com/excpt))
99
+ - Add first content and basic layout [\#144](https://github.com/jwt/ruby-jwt/pull/144) ([excpt](https://github.com/excpt))
100
+ - Add a changelog file [\#142](https://github.com/jwt/ruby-jwt/pull/142) ([excpt](https://github.com/excpt))
101
+ - Return decoded\_segments [\#139](https://github.com/jwt/ruby-jwt/pull/139) ([akostrikov](https://github.com/akostrikov))
102
+
103
+ ## [v1.5.4](https://github.com/jwt/ruby-jwt/tree/v1.5.4) (2016-03-24)
104
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.3...v1.5.4)
105
+
106
+ **Closed issues:**
107
+
108
+ - 404 at https://rubygems.global.ssl.fastly.net/gems/jwt-1.5.3.gem [\#137](https://github.com/jwt/ruby-jwt/issues/137)
109
+
110
+ **Merged pull requests:**
111
+
112
+ - Update README.md [\#138](https://github.com/jwt/ruby-jwt/pull/138) ([excpt](https://github.com/excpt))
113
+ - Fix base64url\_decode [\#136](https://github.com/jwt/ruby-jwt/pull/136) ([excpt](https://github.com/excpt))
114
+ - Fix ruby 1.9.3 compatibility [\#135](https://github.com/jwt/ruby-jwt/pull/135) ([excpt](https://github.com/excpt))
115
+ - iat can be a float value [\#134](https://github.com/jwt/ruby-jwt/pull/134) ([llimllib](https://github.com/llimllib))
116
+
117
+ ## [v1.5.3](https://github.com/jwt/ruby-jwt/tree/v1.5.3) (2016-02-24)
118
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.5.2...v1.5.3)
119
+
120
+ **Implemented enhancements:**
121
+
122
+ - Refactor obsolete code for ruby 1.8 support [\#120](https://github.com/jwt/ruby-jwt/issues/120)
123
+ - Fix "Rubocop/Metrics/CyclomaticComplexity" issue in lib/jwt.rb [\#106](https://github.com/jwt/ruby-jwt/issues/106)
124
+ - Fix "Rubocop/Metrics/CyclomaticComplexity" issue in lib/jwt.rb [\#105](https://github.com/jwt/ruby-jwt/issues/105)
125
+ - Allow a proc to be passed for JTI verification [\#126](https://github.com/jwt/ruby-jwt/pull/126) ([yahooguntu](https://github.com/yahooguntu))
126
+ - Relax restrictions on "jti" claim verification [\#113](https://github.com/jwt/ruby-jwt/pull/113) ([lwe](https://github.com/lwe))
127
+
128
+ **Closed issues:**
129
+
130
+ - Verifications not functioning in latest release [\#128](https://github.com/jwt/ruby-jwt/issues/128)
131
+ - Base64 is generating invalid length base64 strings - cross language interop [\#127](https://github.com/jwt/ruby-jwt/issues/127)
132
+ - Digest::Digest is deprecated; use Digest [\#119](https://github.com/jwt/ruby-jwt/issues/119)
133
+ - verify\_rsa no method 'verify' for class String [\#115](https://github.com/jwt/ruby-jwt/issues/115)
134
+ - Add a changelog [\#111](https://github.com/jwt/ruby-jwt/issues/111)
135
+
136
+ **Merged pull requests:**
137
+
138
+ - Drop ruby 1.9.3 support [\#131](https://github.com/jwt/ruby-jwt/pull/131) ([excpt](https://github.com/excpt))
139
+ - Allow string hash keys in validation configurations [\#130](https://github.com/jwt/ruby-jwt/pull/130) ([tpickett66](https://github.com/tpickett66))
140
+ - Add ruby 2.3.0 for travis ci testing [\#123](https://github.com/jwt/ruby-jwt/pull/123) ([excpt](https://github.com/excpt))
141
+ - Remove obsolete json code [\#122](https://github.com/jwt/ruby-jwt/pull/122) ([excpt](https://github.com/excpt))
142
+ - Add fancy badges to README.md [\#118](https://github.com/jwt/ruby-jwt/pull/118) ([excpt](https://github.com/excpt))
143
+ - Refactor decode and verify functionality [\#117](https://github.com/jwt/ruby-jwt/pull/117) ([excpt](https://github.com/excpt))
144
+ - Drop echoe dependency for gem releases [\#116](https://github.com/jwt/ruby-jwt/pull/116) ([excpt](https://github.com/excpt))
145
+ - Updated readme for iss/aud options [\#114](https://github.com/jwt/ruby-jwt/pull/114) ([ryanmcilmoyl](https://github.com/ryanmcilmoyl))
146
+ - Fix error misspelling [\#112](https://github.com/jwt/ruby-jwt/pull/112) ([kat3kasper](https://github.com/kat3kasper))
147
+
148
+ ## [jwt-1.5.2](https://github.com/jwt/ruby-jwt/tree/jwt-1.5.2) (2015-10-27)
149
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.5.1...jwt-1.5.2)
150
+
151
+ **Implemented enhancements:**
152
+
153
+ - Must we specify algorithm when calling decode to avoid vulnerabilities? [\#107](https://github.com/jwt/ruby-jwt/issues/107)
154
+ - Code review: Rspec test refactoring [\#85](https://github.com/jwt/ruby-jwt/pull/85) ([excpt](https://github.com/excpt))
155
+
156
+ **Fixed bugs:**
157
+
158
+ - aud verifies if aud is passed in, :sub does not [\#102](https://github.com/jwt/ruby-jwt/issues/102)
159
+ - iat check does not use leeway so nbf could pass, but iat fail [\#83](https://github.com/jwt/ruby-jwt/issues/83)
160
+
161
+ **Closed issues:**
162
+
163
+ - Test ticket from Code Climate [\#104](https://github.com/jwt/ruby-jwt/issues/104)
164
+ - Test ticket from Code Climate [\#100](https://github.com/jwt/ruby-jwt/issues/100)
165
+ - Is it possible to decode the payload without validating the signature? [\#97](https://github.com/jwt/ruby-jwt/issues/97)
166
+ - What is audience? [\#96](https://github.com/jwt/ruby-jwt/issues/96)
167
+ - Options hash uses both symbols and strings as keys. [\#95](https://github.com/jwt/ruby-jwt/issues/95)
168
+
169
+ **Merged pull requests:**
170
+
171
+ - Fix incorrect `iat` examples [\#109](https://github.com/jwt/ruby-jwt/pull/109) ([kjwierenga](https://github.com/kjwierenga))
172
+ - Update docs to include instructions for the algorithm parameter. [\#108](https://github.com/jwt/ruby-jwt/pull/108) ([aarongray](https://github.com/aarongray))
173
+ - make sure :sub check behaves like :aud check [\#103](https://github.com/jwt/ruby-jwt/pull/103) ([skippy](https://github.com/skippy))
174
+ - Change hash syntax [\#101](https://github.com/jwt/ruby-jwt/pull/101) ([excpt](https://github.com/excpt))
175
+ - Include LICENSE and README.md in gem [\#99](https://github.com/jwt/ruby-jwt/pull/99) ([bkeepers](https://github.com/bkeepers))
176
+ - Remove unused variable in the sample code. [\#98](https://github.com/jwt/ruby-jwt/pull/98) ([hypermkt](https://github.com/hypermkt))
177
+ - Fix iat claim example [\#94](https://github.com/jwt/ruby-jwt/pull/94) ([larrylv](https://github.com/larrylv))
178
+ - Fix wrong description in README.md [\#93](https://github.com/jwt/ruby-jwt/pull/93) ([larrylv](https://github.com/larrylv))
179
+ - JWT and JWA are now RFC. [\#92](https://github.com/jwt/ruby-jwt/pull/92) ([aj-michael](https://github.com/aj-michael))
180
+ - Update README.md [\#91](https://github.com/jwt/ruby-jwt/pull/91) ([nsarno](https://github.com/nsarno))
181
+ - Fix missing verify parameter in docs [\#90](https://github.com/jwt/ruby-jwt/pull/90) ([ernie](https://github.com/ernie))
182
+ - Iat check uses leeway. [\#89](https://github.com/jwt/ruby-jwt/pull/89) ([aj-michael](https://github.com/aj-michael))
183
+ - nbf check allows exact time matches. [\#88](https://github.com/jwt/ruby-jwt/pull/88) ([aj-michael](https://github.com/aj-michael))
184
+
185
+ ## [jwt-1.5.1](https://github.com/jwt/ruby-jwt/tree/jwt-1.5.1) (2015-06-22)
186
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.5.0...jwt-1.5.1)
187
+
188
+ **Implemented enhancements:**
189
+
190
+ - Fix either README or source code [\#78](https://github.com/jwt/ruby-jwt/issues/78)
191
+ - Validate against draft 20 [\#38](https://github.com/jwt/ruby-jwt/issues/38)
192
+
193
+ **Fixed bugs:**
194
+
195
+ - ECDSA signature verification fails for valid tokens [\#84](https://github.com/jwt/ruby-jwt/issues/84)
196
+ - Shouldn't verification of additional claims, like iss, aud etc. be enforced when in options? [\#81](https://github.com/jwt/ruby-jwt/issues/81)
197
+ - Fix either README or source code [\#78](https://github.com/jwt/ruby-jwt/issues/78)
198
+ - decode fails with 'none' algorithm and verify [\#75](https://github.com/jwt/ruby-jwt/issues/75)
199
+
200
+ **Closed issues:**
201
+
202
+ - Doc mismatch: uninitialized constant JWT::ExpiredSignature [\#79](https://github.com/jwt/ruby-jwt/issues/79)
203
+ - TypeError when specifying a wrong algorithm [\#77](https://github.com/jwt/ruby-jwt/issues/77)
204
+ - jti verification doesn't prevent replays [\#73](https://github.com/jwt/ruby-jwt/issues/73)
205
+
206
+ **Merged pull requests:**
207
+
208
+ - Correctly sign ECDSA JWTs [\#87](https://github.com/jwt/ruby-jwt/pull/87) ([jurriaan](https://github.com/jurriaan))
209
+ - fixed results of decoded tokens in readme [\#86](https://github.com/jwt/ruby-jwt/pull/86) ([piscolomo](https://github.com/piscolomo))
210
+ - Force verification of "iss" and "aud" claims [\#82](https://github.com/jwt/ruby-jwt/pull/82) ([lwe](https://github.com/lwe))
211
+
212
+ ## [jwt-1.5.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.5.0) (2015-05-09)
213
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.4.1...jwt-1.5.0)
214
+
215
+ **Implemented enhancements:**
216
+
217
+ - Needs to support asymmetric key signatures over shared secrets [\#46](https://github.com/jwt/ruby-jwt/issues/46)
218
+ - Implement Elliptic Curve Crypto Signatures [\#74](https://github.com/jwt/ruby-jwt/pull/74) ([jtdowney](https://github.com/jtdowney))
219
+ - Add an option to verify the signature on decode [\#71](https://github.com/jwt/ruby-jwt/pull/71) ([javawizard](https://github.com/javawizard))
220
+
221
+ **Closed issues:**
222
+
223
+ - Check JWT vulnerability [\#76](https://github.com/jwt/ruby-jwt/issues/76)
224
+
225
+ **Merged pull requests:**
226
+
227
+ - Fixed some examples to make them copy-pastable [\#72](https://github.com/jwt/ruby-jwt/pull/72) ([jer](https://github.com/jer))
228
+
229
+ ## [jwt-1.4.1](https://github.com/jwt/ruby-jwt/tree/jwt-1.4.1) (2015-03-12)
230
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.4.0...jwt-1.4.1)
231
+
232
+ **Fixed bugs:**
233
+
234
+ - jti verification not working per the spec [\#68](https://github.com/jwt/ruby-jwt/issues/68)
235
+ - Verify ISS should be off by default [\#66](https://github.com/jwt/ruby-jwt/issues/66)
236
+
237
+ **Merged pull requests:**
238
+
239
+ - Fix \#66 \#68 [\#69](https://github.com/jwt/ruby-jwt/pull/69) ([excpt](https://github.com/excpt))
240
+ - When throwing errors, mention expected/received values [\#65](https://github.com/jwt/ruby-jwt/pull/65) ([rolodato](https://github.com/rolodato))
241
+
242
+ ## [jwt-1.4.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.4.0) (2015-03-10)
243
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.3.0...jwt-1.4.0)
244
+
245
+ **Closed issues:**
246
+
247
+ - The behavior using 'json' differs from 'multi\_json' [\#41](https://github.com/jwt/ruby-jwt/issues/41)
248
+
249
+ **Merged pull requests:**
250
+
251
+ - Release 1.4.0 [\#64](https://github.com/jwt/ruby-jwt/pull/64) ([excpt](https://github.com/excpt))
252
+ - Update README.md and remove dead code [\#63](https://github.com/jwt/ruby-jwt/pull/63) ([excpt](https://github.com/excpt))
253
+ - Add 'iat/ aud/ sub/ jti' support for ruby-jwt [\#62](https://github.com/jwt/ruby-jwt/pull/62) ([ZhangHanDong](https://github.com/ZhangHanDong))
254
+ - Add 'iss' support for ruby-jwt [\#61](https://github.com/jwt/ruby-jwt/pull/61) ([ZhangHanDong](https://github.com/ZhangHanDong))
255
+ - Clarify .encode API in README [\#60](https://github.com/jwt/ruby-jwt/pull/60) ([jbodah](https://github.com/jbodah))
256
+
257
+ ## [jwt-1.3.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.3.0) (2015-02-24)
258
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.2.1...jwt-1.3.0)
259
+
260
+ **Closed issues:**
261
+
262
+ - Signature Verification to Return Verification Error rather than decode error [\#57](https://github.com/jwt/ruby-jwt/issues/57)
263
+ - Incorrect readme for leeway [\#55](https://github.com/jwt/ruby-jwt/issues/55)
264
+ - What is the reason behind stripping the = in base64 encoding? [\#54](https://github.com/jwt/ruby-jwt/issues/54)
265
+ - Preperations for version 2.x [\#50](https://github.com/jwt/ruby-jwt/issues/50)
266
+ - Release a new version [\#47](https://github.com/jwt/ruby-jwt/issues/47)
267
+ - Catch up for ActiveWhatever 4.1.1 series [\#40](https://github.com/jwt/ruby-jwt/issues/40)
268
+
269
+ **Merged pull requests:**
270
+
271
+ - raise verification error for signiture verification [\#58](https://github.com/jwt/ruby-jwt/pull/58) ([punkle](https://github.com/punkle))
272
+ - Added support for not before claim verification [\#56](https://github.com/jwt/ruby-jwt/pull/56) ([punkle](https://github.com/punkle))
273
+ - Preperations for version 2.x [\#49](https://github.com/jwt/ruby-jwt/pull/49) ([excpt](https://github.com/excpt))
274
+
275
+ ## [jwt-1.2.1](https://github.com/jwt/ruby-jwt/tree/jwt-1.2.1) (2015-01-22)
276
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.2.0...jwt-1.2.1)
277
+
278
+ **Closed issues:**
279
+
280
+ - JWT.encode\({"exp": 10}, "secret"\) [\#52](https://github.com/jwt/ruby-jwt/issues/52)
281
+ - JWT.encode\({"exp": 10}, "secret"\) [\#51](https://github.com/jwt/ruby-jwt/issues/51)
282
+
283
+ **Merged pull requests:**
284
+
285
+ - Accept expiration claims as string [\#53](https://github.com/jwt/ruby-jwt/pull/53) ([yarmand](https://github.com/yarmand))
286
+
287
+ ## [jwt-1.2.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.2.0) (2014-11-24)
288
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.13...jwt-1.2.0)
289
+
290
+ **Closed issues:**
291
+
292
+ - set token to expire [\#42](https://github.com/jwt/ruby-jwt/issues/42)
293
+
294
+ **Merged pull requests:**
295
+
296
+ - Added support for `exp` claim [\#45](https://github.com/jwt/ruby-jwt/pull/45) ([zshannon](https://github.com/zshannon))
297
+ - rspec 3 breaks passing tests [\#44](https://github.com/jwt/ruby-jwt/pull/44) ([zshannon](https://github.com/zshannon))
298
+
299
+ ## [jwt-0.1.13](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.13) (2014-05-08)
300
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-1.0.0...jwt-0.1.13)
301
+
302
+ **Closed issues:**
303
+
304
+ - yanking of version 0.1.12 causes issues [\#39](https://github.com/jwt/ruby-jwt/issues/39)
305
+ - Semantic versioning [\#37](https://github.com/jwt/ruby-jwt/issues/37)
306
+ - Update gem to get latest changes [\#36](https://github.com/jwt/ruby-jwt/issues/36)
307
+
308
+ ## [jwt-1.0.0](https://github.com/jwt/ruby-jwt/tree/jwt-1.0.0) (2014-05-07)
309
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.11...jwt-1.0.0)
310
+
311
+ **Closed issues:**
312
+
313
+ - API request - JWT::decoded\_header\(\) [\#26](https://github.com/jwt/ruby-jwt/issues/26)
314
+
315
+ **Merged pull requests:**
316
+
317
+ - return header along with playload after decoding [\#35](https://github.com/jwt/ruby-jwt/pull/35) ([sawyerzhang](https://github.com/sawyerzhang))
318
+ - Raise JWT::DecodeError on nil token [\#34](https://github.com/jwt/ruby-jwt/pull/34) ([tjmw](https://github.com/tjmw))
319
+ - Make MultiJson optional for Ruby 1.9+ [\#33](https://github.com/jwt/ruby-jwt/pull/33) ([petergoldstein](https://github.com/petergoldstein))
320
+ - Allow access to header and payload without signature verification [\#32](https://github.com/jwt/ruby-jwt/pull/32) ([petergoldstein](https://github.com/petergoldstein))
321
+ - Update specs to use RSpec 3.0.x syntax [\#31](https://github.com/jwt/ruby-jwt/pull/31) ([petergoldstein](https://github.com/petergoldstein))
322
+ - Travis - Add Ruby 2.0.0, 2.1.0, Rubinius [\#30](https://github.com/jwt/ruby-jwt/pull/30) ([petergoldstein](https://github.com/petergoldstein))
323
+
324
+ ## [jwt-0.1.11](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.11) (2014-01-17)
325
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.10...jwt-0.1.11)
326
+
327
+ **Closed issues:**
328
+
329
+ - url safe encode and decode [\#28](https://github.com/jwt/ruby-jwt/issues/28)
330
+ - Release [\#27](https://github.com/jwt/ruby-jwt/issues/27)
331
+
332
+ **Merged pull requests:**
333
+
334
+ - fixed urlsafe base64 encoding [\#29](https://github.com/jwt/ruby-jwt/pull/29) ([tobscher](https://github.com/tobscher))
335
+
336
+ ## [jwt-0.1.10](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.10) (2014-01-10)
337
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.8...jwt-0.1.10)
338
+
339
+ **Closed issues:**
340
+
341
+ - change to signature of JWT.decode method [\#14](https://github.com/jwt/ruby-jwt/issues/14)
342
+
343
+ **Merged pull requests:**
344
+
345
+ - Fix warning: assigned but unused variable - e [\#25](https://github.com/jwt/ruby-jwt/pull/25) ([sferik](https://github.com/sferik))
346
+ - Echoe doesn't define a license= method [\#24](https://github.com/jwt/ruby-jwt/pull/24) ([sferik](https://github.com/sferik))
347
+ - Use OpenSSL::Digest instead of deprecated OpenSSL::Digest::Digest [\#23](https://github.com/jwt/ruby-jwt/pull/23) ([JuanitoFatas](https://github.com/JuanitoFatas))
348
+ - Handle some invalid JWTs [\#22](https://github.com/jwt/ruby-jwt/pull/22) ([steved](https://github.com/steved))
349
+ - Add MIT license to gemspec [\#21](https://github.com/jwt/ruby-jwt/pull/21) ([nycvotes-dev](https://github.com/nycvotes-dev))
350
+ - Tweaks and improvements [\#20](https://github.com/jwt/ruby-jwt/pull/20) ([threedaymonk](https://github.com/threedaymonk))
351
+ - Don't leave errors in OpenSSL.errors when there is a decoding error. [\#19](https://github.com/jwt/ruby-jwt/pull/19) ([lowellk](https://github.com/lowellk))
352
+
353
+ ## [jwt-0.1.8](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.8) (2013-03-14)
354
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.7...jwt-0.1.8)
355
+
356
+ **Merged pull requests:**
357
+
358
+ - Contrib and update [\#18](https://github.com/jwt/ruby-jwt/pull/18) ([threedaymonk](https://github.com/threedaymonk))
359
+ - Verify if verify is truthy \(not just true\) [\#17](https://github.com/jwt/ruby-jwt/pull/17) ([threedaymonk](https://github.com/threedaymonk))
360
+
361
+ ## [jwt-0.1.7](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.7) (2013-03-07)
362
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.6...jwt-0.1.7)
363
+
364
+ **Merged pull requests:**
365
+
366
+ - Catch MultiJson::LoadError and reraise as JWT::DecodeError [\#16](https://github.com/jwt/ruby-jwt/pull/16) ([rwygand](https://github.com/rwygand))
367
+
368
+ ## [jwt-0.1.6](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.6) (2013-03-05)
369
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.5...jwt-0.1.6)
370
+
371
+ **Merged pull requests:**
372
+
373
+ - Fixes a theoretical timing attack [\#15](https://github.com/jwt/ruby-jwt/pull/15) ([mgates](https://github.com/mgates))
374
+ - Use StandardError as parent for DecodeError [\#13](https://github.com/jwt/ruby-jwt/pull/13) ([Oscil8](https://github.com/Oscil8))
375
+
376
+ ## [jwt-0.1.5](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.5) (2012-07-20)
377
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.4...jwt-0.1.5)
378
+
379
+ **Closed issues:**
380
+
381
+ - Unable to specify signature header fields [\#7](https://github.com/jwt/ruby-jwt/issues/7)
382
+
383
+ **Merged pull requests:**
384
+
385
+ - MultiJson dependency uses ~\> but should be \>= [\#12](https://github.com/jwt/ruby-jwt/pull/12) ([sporkmonger](https://github.com/sporkmonger))
386
+ - Oops. :-\) [\#11](https://github.com/jwt/ruby-jwt/pull/11) ([sporkmonger](https://github.com/sporkmonger))
387
+ - Fix issue with signature verification in JRuby [\#10](https://github.com/jwt/ruby-jwt/pull/10) ([sporkmonger](https://github.com/sporkmonger))
388
+ - Depend on MultiJson [\#9](https://github.com/jwt/ruby-jwt/pull/9) ([lautis](https://github.com/lautis))
389
+ - Allow for custom headers on encode and decode [\#8](https://github.com/jwt/ruby-jwt/pull/8) ([dgrijalva](https://github.com/dgrijalva))
390
+ - Missing development dependency for echoe gem. [\#6](https://github.com/jwt/ruby-jwt/pull/6) ([sporkmonger](https://github.com/sporkmonger))
391
+
392
+ ## [jwt-0.1.4](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.4) (2011-11-11)
393
+ [Full Changelog](https://github.com/jwt/ruby-jwt/compare/jwt-0.1.3...jwt-0.1.4)
394
+
395
+ **Merged pull requests:**
396
+
397
+ - Fix for RSA verification [\#5](https://github.com/jwt/ruby-jwt/pull/5) ([jordan-brough](https://github.com/jordan-brough))
398
+
399
+ ## [jwt-0.1.3](https://github.com/jwt/ruby-jwt/tree/jwt-0.1.3) (2011-06-30)
400
+ **Closed issues:**
401
+
402
+ - signatures calculated incorrectly \(hexdigest instead of digest\) [\#1](https://github.com/jwt/ruby-jwt/issues/1)
403
+
404
+ **Merged pull requests:**
405
+
406
+ - Bumped a version and added a .gemspec using rake build\_gemspec [\#3](https://github.com/jwt/ruby-jwt/pull/3) ([zhitomirskiyi](https://github.com/zhitomirskiyi))
407
+ - Added RSA support [\#2](https://github.com/jwt/ruby-jwt/pull/2) ([zhitomirskiyi](https://github.com/zhitomirskiyi))
408
+
409
+
410
+
411
+ \* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*