keypairs 1.3.1 → 1.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9a566420b6d4de74512b298c61dfef0674d28c21d42f68a7982f6b45180877e
-  data.tar.gz: 8f37ce5a303975bc0076ab1f9b5b480b7c6b6eac12414a6ab8af1efc9fa6ecff
+  metadata.gz: f204cbb9214023154fb4b23804e6a18b0e6bd929592616fe2cd12b2cd5a180ac
+  data.tar.gz: 487339606bd6d7f0d5b90628147e613784dec153165821172efe26565b4351ba
 SHA512:
-  metadata.gz: f12e76d5246cf84ad5bbe1df70bfb0223e0ddc0f8b9c639980788bbf09b7dc6a4b1b28f8e6d38a823920624724d68a661173df258837f26feb6379f8c8b49087
-  data.tar.gz: 5632b282782f4f5bbac7224d289771cbc78139034924efbe755b8f3419ff920b0ef68d65b5fcb1f435f1cc057d6c18794eff910b019a2395bd81a16ba17fc24d
+  metadata.gz: 38fc480ca4a36beee8c5b5c4658359c0cea284e66a6143e9a5cd8c51247d984b1bdd947b8b6f2e32243c94bd3d0212f7e6d27050cab0eda95140eb0b8be45676
+  data.tar.gz: c9b87af55f4f38a0397a89c25be5a8d7e82b1daa7bb7bd3ef5cd0094c05c8f12a6b7476b146d2d4fc8b8bac42443adedea7db866aa046b294a3f8722bac83ba3

data/lib/keypair.rb

@@ -114,6 +114,14 @@ class Keypair < ActiveRecord::Base
     current.jwt_encode(payload)
   end
 
+  # Encodes the payload with the current keypair.
+  # It forewards the call to the instance method {Keypair#jwt_encode}.
+  # @return [String] Encoded JWT token with security credentials.
+  # @param payload [Hash] Hash which should be encoded.
+  def self.jwt_encode_without_nonce(payload)
+    current.jwt_encode(payload, {}, nonce: false)
+  end
+
   # Decodes the payload and verifies the signature against the current valid keypairs.
   # @param id_token [String] A JWT that should be decoded.
   # @param options [Hash] options for decoding, passed to {JWT::Decode}.
@@ -137,16 +145,9 @@ class Keypair < ActiveRecord::Base
   # It automatically sets the +kid+ in the header.
   # @param payload [Hash] you have to provide a hash since the security attributes have to be added.
   # @param headers [Hash] you can optionally add additional headers to the JWT.
-  def jwt_encode(payload, headers = {})
+  def jwt_encode(payload, headers = {}, nonce: true)
     # Add security claims to payload
-    payload.reverse_merge!(
-      # Time at which the Issuer generated the JWT (epoch).
-      iat: Time.now.to_i,
-
-      # Expiration time on or after which the tool MUST NOT accept the ID Token for
-      # processing (epoch). This is mostly used to allow some clock skew.
-      exp: Time.now.to_i + 5.minutes.to_i
-    )
+    payload = secure_payload(payload, nonce: nonce)
 
     # Add additional info into the headers
     headers.reverse_merge!(
@@ -225,4 +226,23 @@ class Keypair < ActiveRecord::Base
 
     errors.add(:expires_at, 'must be after not after')
   end
+
+  def secure_payload(payload, nonce: true)
+    secure_payload = {
+      # Time at which the Issuer generated the JWT (epoch).
+      iat: Time.now.to_i,
+
+      # Expiration time on or after which the tool MUST NOT accept the ID Token for
+      # processing (epoch). This is mostly used to allow some clock skew.
+      exp: Time.now.to_i + 5.minutes.to_i
+    }
+
+    if nonce
+      # String value used to associate a tool session with an ID Token, and to mitigate replay
+      # attacks. The nonce value is a case-sensitive string.
+      secure_payload[:nonce] = SecureRandom.uuid
+    end
+
+    payload.reverse_merge!(secure_payload)
+  end
 end

data/lib/keypairs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Keypairs
-  VERSION = '1.3.1'
+  VERSION = '1.3.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keypairs
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.3
 platform: ruby
 authors:
 - Stef Schenkelaars