rodauth-oauth 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40ff3b3b3de0595eae98f218aec2f8e876f18329061c537e91e5841ab35e67dc
-  data.tar.gz: 19692e86d66400a9e7227f655bdc6375e38554cb52b97ee3a5e22cceab582168
+  metadata.gz: 9fc6216412a63e6ce3b6beecf2d476b50b8e3445026927ce40cdc649023c1b15
+  data.tar.gz: d5f2f5ea24ade170615894f352a28ed428fac7a0bb39db4506d8343ead0c2e07
 SHA512:
-  metadata.gz: cd6efdeda012c25d83949e7f0ea2aa043238851f95bf1217b8156786f7376d39792caed37a2af68fc7777ed5a892fa2f9e5185efe1f8a3e7168df07de84b954d
-  data.tar.gz: 0e435eea239f81ff16db08b187ce7bb06ba3d25359603906e48610e38912162b35c79c3d8b7fbfa74df2c56f52bb653d61b999da76c1cc8d445f2077b876c578
+  metadata.gz: 984a083c4e8814244c8566106a757095ae046b049ad76c6fa2947e5a7d12b0bc63c5fba621c1a0674e3deb4246a7f09d228ee51bb0e4f16a81c25bcd1a28d04c
+  data.tar.gz: 0aafc4b37f059b134ce08940d8e38d9ed3afb577e80c790b646c45ce0792ba6d833582ac53c036f9449ee3b130f77e4f5fc9098ce1ed3614b969dd78219eecba

data/doc/release_notes/1_6_0.md

@@ -0,0 +1,18 @@
+# 1.6.0
+
+## Improvements
+
+### "at+jwt" and "id_token+jwt" ty header in JWT tokens
+
+In order to distinguish/identify tokens, JWT access tokens generated by the `oauth_jwt` feature will contain the "at+jwt" value in the "typ" header (which follows the [recomendation in the RFC](https://datatracker.ietf.org/doc/html/rfc9068#section-2.1)), whereas ID tokens generated by the `oidc` feature will contain the "id_token+jwt" value in the "typ" header (there is no official recommendation, but some providers are using this).
+
+**Note**: This header will also be used to validate access tokens. This means that, once you upgrade, **access tokens generated prior to the upgrade won't be usable anymore**. In order to mitigate this and smoothen the upgrade process, disable header verification for a period greater than the access token expiration time in your application (controlled by the `oauth_access_token_expires_in` auth value method, 60 minutes by default); this will allow older access tokens to expire. You can so by overriding the `verify_access_token_headers` auth method:
+
+```ruby
+
+rodauth do
+  enable :oauth_jwt # or :oidc
+  oauth_access_token_expires_in 60 * 60
+
+  verify_access_token_headers { } # do nothing
+end

data/lib/rodauth/features/oauth_jwt.rb

@@ -9,7 +9,10 @@ module Rodauth
 
     auth_value_method :oauth_jwt_access_tokens, true
 
-    auth_methods(:jwt_claims)
+    auth_methods(
+      :jwt_claims,
+      :verify_access_token_headers
+    )
 
     def require_oauth_authorization(*scopes)
       return super unless oauth_jwt_access_tokens
@@ -53,10 +56,14 @@ module Rodauth
       @authorization_token = decode_access_token
     end
 
+    def verify_access_token_headers(headers)
+      headers["typ"] == "at+jwt"
+    end
+
     def decode_access_token(access_token = fetch_access_token)
       return unless access_token
 
-      jwt_claims = jwt_decode(access_token)
+      jwt_claims = jwt_decode(access_token, verify_headers: method(:verify_access_token_headers))
 
       return unless jwt_claims
 
@@ -94,7 +101,9 @@ module Rodauth
       # token data.
       claims[:scope] = oauth_grant[oauth_grants_scopes_column]
 
-      jwt_encode(claims)
+      # RFC8725 section 3.11: Use Explicit Typing
+      # RFC9068 section 2.1 : The "typ" value used SHOULD be "at+jwt".
+      jwt_encode(claims, headers: { typ: "at+jwt" })
     end
 
     def _generate_access_token(*)

data/lib/rodauth/features/oidc.rb

@@ -545,7 +545,11 @@ module Rodauth
         jwks: oauth_application_jwks(oauth_application),
         signing_algorithm: signing_algorithm,
         encryption_algorithm: oauth_application[oauth_applications_id_token_encrypted_response_alg_column],
-        encryption_method: oauth_application[oauth_applications_id_token_encrypted_response_enc_column]
+        encryption_method: oauth_application[oauth_applications_id_token_encrypted_response_enc_column],
+
+        # Not officially part of the spec, but some providers follow this convention.
+        # This is useful for distinguishing between ID Tokens and JWT Access Tokens.
+        headers: { typ: "id_token+jwt" }
       }.compact
 
       oauth_grant[:id_token] = jwt_encode(id_claims, **params)

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.5.0"
+    VERSION = "1.6.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-02-02 00:00:00.000000000 Z
+date: 2024-04-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -74,6 +74,7 @@ extra_rdoc_files:
 - doc/release_notes/1_3_2.md
 - doc/release_notes/1_4_0.md
 - doc/release_notes/1_5_0.md
+- doc/release_notes/1_6_0.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -119,6 +120,7 @@ files:
 - doc/release_notes/1_3_2.md
 - doc/release_notes/1_4_0.md
 - doc/release_notes/1_5_0.md
+- doc/release_notes/1_6_0.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb