keypairs 1.3.1 → 1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9a566420b6d4de74512b298c61dfef0674d28c21d42f68a7982f6b45180877e
-  data.tar.gz: 8f37ce5a303975bc0076ab1f9b5b480b7c6b6eac12414a6ab8af1efc9fa6ecff
+  metadata.gz: 3825e9ab54265b0413ed34458988e36a473284609021a930caee44aae4ff2902
+  data.tar.gz: dcd24440ff3a15560aa39d6c2da387944f147e89ecdad9e03a54e7de9faa69e2
 SHA512:
-  metadata.gz: f12e76d5246cf84ad5bbe1df70bfb0223e0ddc0f8b9c639980788bbf09b7dc6a4b1b28f8e6d38a823920624724d68a661173df258837f26feb6379f8c8b49087
-  data.tar.gz: 5632b282782f4f5bbac7224d289771cbc78139034924efbe755b8f3419ff920b0ef68d65b5fcb1f435f1cc057d6c18794eff910b019a2395bd81a16ba17fc24d
+  metadata.gz: d5b96c7cb4e2a6153b124be6dae5a62c37e43d5eebd9ade45b44fa1efe5f3baca918a654f0991cff393036b18209429da38c0325d3a69e930e0e719ee0651467
+  data.tar.gz: 5b5860d35ce4ccc9c4f6fbb1239163d667758f6401f760387e125e89190f24de3ef2e7e79af3cc6d0142021cd7fbb6dc695bb34ac551fbbf148ff35bfc48cf0d

data/lib/keypair.rb

@@ -114,6 +114,14 @@ class Keypair < ActiveRecord::Base
     current.jwt_encode(payload)
   end
 
+  # Encodes the payload with the current keypair.
+  # It forewards the call to the instance method {Keypair#jwt_encode}.
+  # @return [String] Encoded JWT token with security credentials.
+  # @param payload [Hash] Hash which should be encoded.
+  def self.jwt_encode_without_nonce(payload)
+    current.jwt_encode_without_nonce(payload, {}, nonce: false)
+  end
+
   # Decodes the payload and verifies the signature against the current valid keypairs.
   # @param id_token [String] A JWT that should be decoded.
   # @param options [Hash] options for decoding, passed to {JWT::Decode}.
@@ -137,16 +145,9 @@ class Keypair < ActiveRecord::Base
   # It automatically sets the +kid+ in the header.
   # @param payload [Hash] you have to provide a hash since the security attributes have to be added.
   # @param headers [Hash] you can optionally add additional headers to the JWT.
-  def jwt_encode(payload, headers = {})
+  def jwt_encode(payload, headers = {}, nonce: true)
     # Add security claims to payload
-    payload.reverse_merge!(
-      # Time at which the Issuer generated the JWT (epoch).
-      iat: Time.now.to_i,
-
-      # Expiration time on or after which the tool MUST NOT accept the ID Token for
-      # processing (epoch). This is mostly used to allow some clock skew.
-      exp: Time.now.to_i + 5.minutes.to_i
-    )
+    payload = secure_payload(payload, nonce: nonce)
 
     # Add additional info into the headers
     headers.reverse_merge!(
@@ -225,4 +226,23 @@ class Keypair < ActiveRecord::Base
 
     errors.add(:expires_at, 'must be after not after')
   end
+
+  def secure_payload(payload, nonce: true)
+    secure_payload = {
+      # Time at which the Issuer generated the JWT (epoch).
+      iat: Time.now.to_i,
+
+      # Expiration time on or after which the tool MUST NOT accept the ID Token for
+      # processing (epoch). This is mostly used to allow some clock skew.
+      exp: Time.now.to_i + 5.minutes.to_i
+    }
+
+    if nonce
+      # String value used to associate a tool session with an ID Token, and to mitigate replay
+      # attacks. The nonce value is a case-sensitive string.
+      secure_payload[:nonce] = SecureRandom.uuid
+    end
+
+    payload.reverse_merge!(secure_payload)
+  end
 end

data/lib/keypairs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Keypairs
-  VERSION = '1.3.1'
+  VERSION = '1.3.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keypairs
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.2
 platform: ruby
 authors:
 - Stef Schenkelaars