sandal 0.5.2 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b9335b993fe3eba12af0ce2a5f5b548495cb236e
-  data.tar.gz: acc295000fad37701881ec296247358ea5e1527c
+  metadata.gz: 7ff4b80562db5433640998a394546147889b724e
+  data.tar.gz: 57ab4cfaf1b8145f179bebc192142428cc2d8b4a
 SHA512:
-  metadata.gz: 4946603d929b6f6c063a458fe63d2f8847ecf3b97ef0c8e9fab3ea57119cd2bdee51c070dea1e693778e9a53b90c58a43a6c012cd4d24a59510e5593d0fe40ed
-  data.tar.gz: 62f892126c09d7dd8845be99120230a4858a51d501efef370a8afb2f35569ab1167a252bb655f985c8cf85fccfbc0f4577e3550af67bd852f3631f8770d4d3f5
+  metadata.gz: 152b2ee352ff3d3ae11a4cc301e7f61b39f9b668678dd2049b0c3246e57b2633b9cbb0adc62d82cd4a920befd8d2b89fae13b5104e26b2a2e2edf9b216599ca2
+  data.tar.gz: c57f26aefdecb14a9d9966b21ca1e3fdf8016b9cc0b201f432a59f90a8f3030d87fac71cac3530fe2d449ed316286c21cbac37ddf946c18cbe11736bdc26182b

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.6.0 (28 February 2014)
+
+Breaking changes:
+
+- Changed the behaviour around unsigned tokens so that they are rejected by default, to make the default settings more secure.
+
 ## 0.5.2 (03 January 2014)
 
 Improvements:

data/README.md

@@ -1,4 +1,4 @@
-# Sandal [![Build Status](https://travis-ci.org/gregbeech/sandal.png?branch=master)](https://travis-ci.org/gregbeech/sandal) [![Coverage Status](https://coveralls.io/repos/gregbeech/sandal/badge.png?branch=master)](https://coveralls.io/r/gregbeech/sandal) [![Code Climate](https://codeclimate.com/github/gregbeech/sandal.png)](https://codeclimate.com/github/gregbeech/sandal) [![Dependency Status](https://gemnasium.com/gregbeech/sandal.png)](https://gemnasium.com/gregbeech/sandal)
+# Sandal [![Gem Version](https://badge.fury.io/rb/sandal.png)](http://badge.fury.io/rb/sandal) [![Build Status](https://travis-ci.org/gregbeech/sandal.png?branch=master)](https://travis-ci.org/gregbeech/sandal) [![Coverage Status](https://coveralls.io/repos/gregbeech/sandal/badge.png?branch=master)](https://coveralls.io/r/gregbeech/sandal) [![Code Climate](https://codeclimate.com/github/gregbeech/sandal.png)](https://codeclimate.com/github/gregbeech/sandal) [![Dependency Status](https://gemnasium.com/gregbeech/sandal.png)](https://gemnasium.com/gregbeech/sandal)
 
 A Ruby library for creating and reading [JSON Web Tokens (JWT) draft-13](http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-13), supporting [JSON Web Signatures (JWS) draft-18](http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-18) and [JSON Web Encryption (JWE) draft-18](http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-18). See the [CHANGELOG](CHANGELOG.md) for version history.
 
@@ -114,6 +114,15 @@ Sandal.default! ignore_signature: true, ignore_exp: true
 
 These options can also be configured on a per-token basis by using a second `options` parameter in the block passed to the `decode` method.
 
+Note that by default the library requires that the innermost token is signed as this is the most secure option. To enable decoding tokens that don't meet this policy you can disable it as shown below, although I'd strongly recommend that you just allow the token to be rejected!
+
+```ruby
+payload = Sandal.decode_token(unsafe_token) do |header, options|
+  options[:signature_policy] = :none
+  Sandal::Sig::NONE
+end
+```
+
 ## Contributing
 
 1. Fork it

data/lib/sandal.rb

@@ -50,6 +50,10 @@ module Sandal
   # max_clock_skew:: 
   #   The maximum clock skew, in seconds, when validating times. If your server time is out of sync with the token
   #   server then this can be increased to take that into account. It probably shouldn't be more than about 300.
+  # signature_policy::
+  #   The policy for requiring signatures in tokens. The possible values are:
+  #   - :strict (default) - The innermost token must be signed. This is the recommended policy.
+  #   - :none - No signature is required. This _really_ isn't recommended.
   # valid_iss:: 
   #   A list of valid token issuers, if validation of the issuer claim is required.
   # valid_aud:: 
@@ -59,6 +63,7 @@ module Sandal
     ignore_nbf: false,
     ignore_signature: false,
     max_clock_skew: 0,
+    signature_policy: :strict,
     valid_iss: [],
     valid_aud: []
   }
@@ -188,6 +193,9 @@ module Sandal
         payload
       end
     else
+      if options[:signature_policy] == :strict && !is_signed?(parts)
+        raise Sandal::UnsupportedTokenError, "The innermost token is not signed."
+      end
       parse_and_validate(payload, options)
     end
   end
@@ -196,10 +204,10 @@ module Sandal
 
   # Decodes and validates a signed JSON Web Token.
   def self.validate_signature(parts, signature, validator)
-    validator ||= Sandal::Sig::NONE
+    raise UnsupportedTokenError, "Unsupported signature method." if validator.nil?
     secured_input = parts.take(2).join(".")
     unless validator.valid?(signature, secured_input)
-      raise TokenError, "Invalid signature."
+      raise InvalidTokenError, "Invalid signature."
     end
   end
 
@@ -209,7 +217,7 @@ module Sandal
     parts[0] = Sandal::Json.load(parts[0])
     parts
   rescue
-    raise TokenError, "Invalid token encoding."
+    raise InvalidTokenError, "Invalid token encoding."
   end
 
   # Parses the content of a token and validates the claims if is JSON claims.

data/lib/sandal/version.rb

@@ -1,4 +1,4 @@
 module Sandal
   # The semantic version of the library.
-  VERSION = "0.5.2"
+  VERSION = "0.6.0"
 end

data/sandal.gemspec

@@ -28,5 +28,5 @@ Gem::Specification.new do |s|
   s.add_development_dependency "redcarpet", ">= 2.2" unless RUBY_PLATFORM == "java" # for yard
   s.add_development_dependency "kramdown", ">= 1.0" if RUBY_PLATFORM == "java"      # for yard
 
-  s.requirements << "openssl 1.0.1c for EC signature methods"
+  s.requirements << "OpenSSL 1.0.1c for EC signature methods (1.0.1f recommended)"
 end

data/spec/sandal_spec.rb

@@ -10,7 +10,8 @@ describe Sandal do
       private_key = OpenSSL::PKey::RSA.new(2048)
       encrypter = Sandal::Enc::A128CBC_HS256.new(Sandal::Enc::Alg::RSA1_5.new(private_key.public_key))
       token = Sandal.encrypt_token(payload, encrypter, { 'zip' => 'DEF' })
-      decoded_payload = Sandal.decode_token(token) do |header|
+      decoded_payload = Sandal.decode_token(token) do |header, options|
+        options[:signature_policy] = :none
         Sandal::Enc::A128CBC_HS256.new(Sandal::Enc::Alg::RSA1_5.new(private_key))
       end
       expect(decoded_payload).to eq(payload)
@@ -32,6 +33,28 @@ describe Sandal do
 
   end
 
+  context "#decode_token" do
+
+    it 'does not accept tokens with no signatures by default' do
+      payload = 'some payload to be zipped'
+      token = Sandal.encode_token(payload, Sandal::Sig::NONE)
+      expect { Sandal.decode_token(token) do |header, options|
+        Sandal::Sig::NONE
+      end }.to raise_error Sandal::UnsupportedTokenError
+    end
+
+    it 'does not accept encrypted tokens with no signatures by default' do
+      payload = 'some payload to be zipped'
+      private_key = OpenSSL::PKey::RSA.new(2048)
+      encrypter = Sandal::Enc::A128CBC_HS256.new(Sandal::Enc::Alg::RSA1_5.new(private_key.public_key))
+      token = Sandal.encrypt_token(payload, encrypter)
+      expect { Sandal.decode_token(token) do |header, options|
+        Sandal::Enc::A128CBC_HS256.new(Sandal::Enc::Alg::RSA1_5.new(private_key))
+      end }.to raise_error Sandal::UnsupportedTokenError
+    end
+
+  end
+
   it 'raises a token error when the token format is invalid' do
     expect { Sandal.decode_token('not a valid token') }.to raise_error Sandal::TokenError
   end
@@ -43,42 +66,61 @@ describe Sandal do
   it 'encodes and decodes tokens with no signature' do
     payload = 'Hello, World'
     token = Sandal.encode_token(payload, nil)
-    decoded_payload = Sandal.decode_token(token)
+    decoded_payload = Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end
     expect(decoded_payload).to eq(payload)
   end
 
   it 'encodes and decodes tokens with "none" signature' do
     payload = 'Hello, World'
-    token = Sandal.encode_token(payload, Sandal::Sig::None.instance)
-    decoded_payload = Sandal.decode_token(token)
+    token = Sandal.encode_token(payload, Sandal::Sig::NONE)
+    decoded_payload = Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end
     expect(decoded_payload).to eq(payload)
   end
 
   it 'decodes non-JSON payloads to a String' do
     token = Sandal.encode_token('not valid json', nil)
-    expect(Sandal.decode_token(token)).to be_kind_of String
+    expect(Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end).to be_kind_of String
   end
 
   it 'decodes JSON payloads to a Hash' do
     token = Sandal.encode_token({ 'valid' => 'json' }, nil)
-    expect(Sandal.decode_token(token)).to be_kind_of Hash
+    expect(Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end).to be_kind_of Hash
   end
 
   it 'raises a claim error when the expiry date is far in the past' do
     token = Sandal.encode_token({ 'exp' => (Time.now - 600).to_i }, nil)
-    expect { Sandal.decode_token(token) }.to raise_error Sandal::ClaimError
+    expect { Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end }.to raise_error Sandal::ClaimError
   end
 
   it 'raises a claim error when the expiry date is invalid' do
     token = Sandal.encode_token({ 'exp' => 'invalid value' }, nil)
-    expect { Sandal.decode_token(token) }.to raise_error Sandal::ClaimError
+    expect { Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end }.to raise_error Sandal::ClaimError
   end
 
   it 'does not raise an error when the expiry date is in the past but validation is disabled' do
     token = Sandal.encode_token({ 'exp' => (Time.now - 600).to_i }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:ignore_exp] = true
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 
@@ -86,30 +128,41 @@ describe Sandal do
     token = Sandal.encode_token({ 'exp' => (Time.now - 60).to_i }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:max_clock_skew] = 300
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 
   it 'does not raise an error when the expiry date is valid' do
     token = Sandal.encode_token({ 'exp' => (Time.now + 60).to_i }, nil)
-    Sandal.decode_token(token)
+    Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end
   end
 
   it 'raises a claim error when the not-before date is far in the future' do
     token = Sandal.encode_token({ 'nbf' => (Time.now + 600).to_i }, nil)
-    expect { Sandal.decode_token(token) }.to raise_error Sandal::ClaimError
+    expect { Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end }.to raise_error Sandal::ClaimError
   end
 
   it 'raises a claim error when the not-before date is invalid' do
     token = Sandal.encode_token({ 'nbf' => 'invalid value' }, nil)
-    expect { Sandal.decode_token(token) }.to raise_error Sandal::ClaimError
+    expect { Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end }.to raise_error Sandal::ClaimError
   end
 
   it 'does not raise an error when the not-before date is in the future but validation is disabled' do
     token = Sandal.encode_token({ 'nbf' => (Time.now + 600).to_i }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:ignore_nbf] = true
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 
@@ -117,20 +170,25 @@ describe Sandal do
     token = Sandal.encode_token({ 'nbf' => (Time.now + 60).to_i }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:max_clock_skew] = 300
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 
   it 'does not raise an error when the not-before is valid' do
     token = Sandal.encode_token({ 'nbf' => (Time.now - 60).to_i }, nil)
-    Sandal.decode_token(token)
+    Sandal.decode_token(token) do |header, options|
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
+    end
   end
 
   it 'raises a claim error when the issuer is not valid' do
     token = Sandal.encode_token({ 'iss' => 'example.org' }, nil)
     expect { Sandal.decode_token(token) do |header, options|
       options[:valid_iss] = ['example.net']
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end }.to raise_error Sandal::ClaimError
   end
 
@@ -138,7 +196,8 @@ describe Sandal do
     token = Sandal.encode_token({ 'iss' => 'example.org' }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:valid_iss] = ['example.org', 'example.com']
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 
@@ -146,7 +205,8 @@ describe Sandal do
     token = Sandal.encode_token({ 'aud' => 'example.com' }, nil)
     expect { Sandal.decode_token(token) do |header, options|
       options[:valid_aud] = ['example.net']
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end }.to raise_error Sandal::ClaimError
   end
 
@@ -154,7 +214,8 @@ describe Sandal do
     token = Sandal.encode_token({ 'aud' => ['example.org', 'example.com'] }, nil)
     expect { Sandal.decode_token(token) do |header, options|
       options[:valid_aud] = ['example.net']
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end }.to raise_error Sandal::ClaimError
   end
 
@@ -162,7 +223,8 @@ describe Sandal do
     token = Sandal.encode_token({ 'aud' => 'example.net' }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:valid_aud] = ['example.net']
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 
@@ -170,7 +232,8 @@ describe Sandal do
     token = Sandal.encode_token({ 'aud' => ['example.com', 'example.net'] }, nil)
     Sandal.decode_token(token) do |header, options|
       options[:valid_aud] = ['example.net']
-      nil
+      options[:signature_policy] = :none
+      Sandal::Sig::NONE
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sandal
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.6.0
 platform: ruby
 authors:
 - Greg Beech
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-02-03 00:00:00.000000000 Z
+date: 2014-02-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -178,9 +178,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements:
-- openssl 1.0.1c for EC signature methods
+- OpenSSL 1.0.1c for EC signature methods (1.0.1f recommended)
 rubyforge_project: 
-rubygems_version: 2.2.0
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: A JSON Web Token (JWT) library.