@carecard/auth-util 3.0.1 → 3.0.2

package/lib/jwtUtilAuth.js

@@ -17,10 +17,11 @@ const _assembleJwt = ( headerBase64, payloadBase64, signatureBase64 ) => {
  * @param headerObject
  * @returns {{alg: string, typ: string}}
  */
-const normalizeHeader = (headerObject ) => {
-    headerObject.alg = headerObject.alg || 'EdDSA';
-    headerObject.typ = 'JWT';
-    return headerObject;
+const normalizeHeader = ( headerObject ) => {
+    const header = { ...headerObject };
+    header.alg = header.alg || 'EdDSA';
+    header.typ = 'JWT';
+    return header;
 };
 
 /**
@@ -28,27 +29,30 @@ const normalizeHeader = (headerObject ) => {
  * @param payloadObject
  * @returns {*}
  */
-const normalizePayload = (payloadObject ) => {
+const normalizePayload = ( payloadObject ) => {
+    const payload = { ...payloadObject };
     const now = Math.floor( Date.now() / 1000 );
     const fieldsToNormalize = [ 'iat', 'exp', 'nbf', 'auth_time' ];
     const msThreshold = 1000000000000;
 
-    if ( !payloadObject.iat ) {
-        payloadObject.iat = now;
+    if ( !payload.iat ) {
+        payload.iat = now;
     }
 
     fieldsToNormalize.forEach( field => {
-        if ( payloadObject[ field ] && payloadObject[ field ] > msThreshold ) {
-            payloadObject[ field ] = Math.floor( payloadObject[ field ] / 1000 );
+        if ( payload[ field ] && payload[ field ] > msThreshold ) {
+            payload[ field ] = Math.floor( payload[ field ] / 1000 );
         }
     } );
 
-    if ( !payloadObject.exp ) {
+    if ( !payload.exp ) {
         // Default 1 hour expiration if not provided
-        payloadObject.exp = payloadObject.iat + 3600;
+        payload.exp = payload.iat + 3600;
+    } else if ( payload.exp > msThreshold ) {
+        payload.exp = Math.floor( payload.exp / 1000 );
     }
 
-    return payloadObject;
+    return payload;
 };
 
 /**
@@ -69,14 +73,18 @@ const _splitJwtInToHeaderPayloadSignature = ( jwt ) => {
  */
 const createSignedJwtFromObject = ( headerObject, payloadObject, privateKey ) => {
     try {
-        headerObject = normalizeHeader( headerObject );
-        payloadObject = normalizePayload( payloadObject );
+        if ( !privateKey ) return null;
 
-        const headerBase64UrlSafe = stringUtilAuth.objectToBase64UrlSafeString( headerObject );
-        const payloadBase64UrlSafe = stringUtilAuth.objectToBase64UrlSafeString( payloadObject );
+        const header = normalizeHeader( headerObject );
+        const payload = normalizePayload( payloadObject );
+
+        const headerBase64UrlSafe = stringUtilAuth.objectToBase64UrlSafeString( header );
+        const payloadBase64UrlSafe = stringUtilAuth.objectToBase64UrlSafeString( payload );
         const token = headerBase64UrlSafe + "." + payloadBase64UrlSafe;
-        const signature = cryptoUtilAuth.createBase64SignatureOfToken( token, privateKey, headerObject.alg );
+
+        const signature = cryptoUtilAuth.createBase64SignatureOfToken( token, privateKey, header.alg );
         const urlSafeSignature = stringUtilAuth.makeStringUrlSafe( signature );
+
         return _assembleJwt( headerBase64UrlSafe, payloadBase64UrlSafe, urlSafeSignature );
     } catch ( error ) {
         return null;
@@ -91,10 +99,14 @@ const createSignedJwtFromObject = ( headerObject, payloadObject, privateKey ) =>
  */
 const verifyJwtSignature = ( jwt, publicKey ) => {
     try {
-        const { header, payload, signature } = _splitJwtInToHeaderPayloadSignature( jwt );
-        const token = header + "." + payload;
+        if ( !jwt || !publicKey ) return false;
+        const parts = _splitJwtInToHeaderPayloadSignature( jwt );
+        if ( !parts ) return false;
+        const { header, signature } = parts;
+        const token = header + "." + parts.payload;
         const headerObject = stringUtilAuth.urlSafeBase64ToObject( header );
-        return cryptoUtilAuth.verifyBase64SignatureOfToken( token, signature, publicKey, headerObject.alg )
+        const signatureBase64 = stringUtilAuth.reverseStringUrlSafe( signature );
+        return cryptoUtilAuth.verifyBase64SignatureOfToken( token, signatureBase64, publicKey, headerObject.alg )
     } catch ( error ) {
         return false;
     }
@@ -106,10 +118,16 @@ const verifyJwtSignature = ( jwt, publicKey ) => {
  * @return {{payload: any, header: any}}
  */
 const getHeaderPayloadFromJwt = jwt => {
-    const { header, payload } = _splitJwtInToHeaderPayloadSignature( jwt );
-    let headerAscii = stringUtilAuth.base64ToAscii( header );
-    let payloadAscii = stringUtilAuth.base64ToAscii( payload );
-    return { header: JSON.parse( headerAscii ), payload: JSON.parse( payloadAscii ) }
+    try {
+        const parts = _splitJwtInToHeaderPayloadSignature( jwt );
+        if ( !parts ) return null;
+        const { header, payload } = parts;
+        let headerObject = stringUtilAuth.urlSafeBase64ToObject( header );
+        let payloadObject = stringUtilAuth.urlSafeBase64ToObject( payload );
+        return { header: headerObject, payload: payloadObject }
+    } catch ( e ) {
+        return null;
+    }
 };
 
 

package/lib/stringUtilAuth.js

@@ -74,6 +74,7 @@ const dollarSignConnectedStringToAlgorithmHashSalt = ( passwordHash ) => {
  * return null if error
  */
 const dotConnectedStringToHeaderPayloadSignature = ( jwt ) => {
+    if ( typeof jwt !== 'string' ) return null;
     const splitJWT = jwt.split( '.' );
     if ( splitJWT.length !== 3 ) return null;
     return {
@@ -90,9 +91,7 @@ const dotConnectedStringToHeaderPayloadSignature = ( jwt ) => {
  * @return {string}
  */
 const objectToBase64UrlSafeString = object => {
-    let stringAscii = JSON.stringify( object );
-    let base64String = asciiToBase64( stringAscii );
-    return makeStringUrlSafe( base64String );
+    return Buffer.from( JSON.stringify( object ) ).toString( 'base64url' );
 };
 
 /**
@@ -101,9 +100,7 @@ const objectToBase64UrlSafeString = object => {
  * @return {any}
  */
 const urlSafeBase64ToObject = urlSafeBase64String => {
-    let base64String = reverseStringUrlSafe( urlSafeBase64String );
-    let stringAscii = base64ToAscii( base64String );
-    return JSON.parse( stringAscii );
+    return JSON.parse( Buffer.from( urlSafeBase64String, 'base64url' ).toString( 'utf8' ) );
 };
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/auth-util",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "repository": "https://github.com/CareCard-ca/pkg-auth-util.git",
   "description": "Auth utility functions",
   "main": "index.js",