@cfworker/jwt 1.12.2 → 2.0.0

package/README.md

@@ -8,7 +8,7 @@
 
 Tiny lib for decoding JWTs and verifying signatures, using native crypto APIs.
 
-Currently supports `alg:'RS256'` only.
+Currently supports RS256, RS384, and RS512.
 
 ```js
 const jwt = request.headers.get('Authorization');

package/dist/algs.d.ts

@@ -0,0 +1,2 @@
+export declare const algToHash: Record<string, string>;
+export declare const algs: string[];

package/dist/algs.js

@@ -0,0 +1,6 @@
+export const algToHash = {
+    RS256: 'SHA-256',
+    RS384: 'SHA-384',
+    RS512: 'SHA-512'
+};
+export const algs = Object.keys(algToHash);

package/dist/decode.js

@@ -1,10 +1,11 @@
-import { decode } from '@cfworker/base64url';
+import { base64url } from 'rfc4648';
 export function decodeJwt(token) {
     const [header, payload, signature] = token.split('.');
+    const decoder = new TextDecoder();
     return {
-        header: JSON.parse(decode(header)),
-        payload: JSON.parse(decode(payload)),
-        signature: decode(signature),
+        header: JSON.parse(decoder.decode(base64url.parse(header, { loose: true }))),
+        payload: JSON.parse(decoder.decode(base64url.parse(payload, { loose: true }))),
+        signature: base64url.parse(signature, { loose: true }),
         raw: { header, payload, signature }
     };
 }

package/dist/jwks.js

@@ -1,3 +1,4 @@
+import { algToHash } from './algs.js';
 export async function getJwks(issuer) {
     const url = new URL(issuer);
     if (!url.pathname.endsWith('/')) {
@@ -12,16 +13,16 @@ export async function getJwks(issuer) {
 }
 const importedKeys = {};
 export async function importKey(iss, jwk) {
-    const input = {
-        kty: 'RSA',
-        e: 'AQAB',
-        n: jwk.n,
-        alg: 'RS256',
-        ext: true
-    };
-    const key = await crypto.subtle.importKey('jwk', input, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+    if (jwk.kty !== 'RSA') {
+        throw new Error(`Unsupported jwk key type (kty) "${jwk.kty}".`);
+    }
+    const hash = jwk.alg ? algToHash[jwk.alg] : null;
+    if (!hash) {
+        throw new Error(`Unsupported jwk Algorithm (alg) "${jwk.alg}".`);
+    }
+    const key = await crypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash }, false, ['verify']);
     importedKeys[iss] = importedKeys[iss] || {};
-    importedKeys[iss][jwk.kid || 'default'] = key;
+    importedKeys[iss][jwk.kid ?? 'default'] = key;
 }
 export async function getKey(decoded) {
     let { header: { kid = 'default' }, payload: { iss } } = decoded;

package/dist/parse.js

@@ -1,3 +1,4 @@
+import { algs, algToHash } from './algs.js';
 import { decodeJwt } from './decode.js';
 import { getKey } from './jwks.js';
 import { verifyJwtSignature } from './verify.js';
@@ -16,10 +17,10 @@ export async function parseJwt(encodedToken, issuer, audience) {
             reason: `Invalid JWT type "${decoded.header.typ}". Expected "JWT".`
         };
     }
-    if (decoded.header.alg !== 'RS256') {
+    if (!algToHash[decoded.header.alg]) {
         return {
             valid: false,
-            reason: `Invalid JWT algorithm "${decoded.header.alg}". Expected "RS256".`
+            reason: `Invalid JWT algorithm "${decoded.header.alg}". Supported: ${algs}.`
         };
     }
     if (typeof decoded.payload.aud === 'string' &&

package/dist/types.d.ts

@@ -18,7 +18,7 @@ export interface RawJwt {
 export interface DecodedJwt {
     header: JwtHeader;
     payload: JwtPayload;
-    signature: string;
+    signature: Uint8Array;
     raw: RawJwt;
 }
 export interface JsonWebKeyset {

package/dist/verify.js

@@ -1,6 +1,5 @@
 export async function verifyJwtSignature(decoded, key) {
     const encoder = new TextEncoder();
     const data = encoder.encode(`${decoded.raw.header}.${decoded.raw.payload}`);
-    const signature = new Uint8Array(Array.from(decoded.signature).map(c => c.charCodeAt(0)));
-    return crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, data);
+    return crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, decoded.signature, data);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cfworker/jwt",
-  "version": "1.12.2",
+  "version": "2.0.0",
   "description": "Tiny lib for decoding JWTs and verifying signatures, using native crypto APIs",
   "keywords": [
     "jwt",
@@ -34,9 +34,9 @@
     "test": "cfworker test test/**/*.spec.ts --nocheck"
   },
   "dependencies": {
-    "@cfworker/base64url": "^1.12.2",
     "@cfworker/worker-types": "^1.12.1",
-    "@cloudflare/workers-types": "^2.2.2"
+    "@cloudflare/workers-types": "^2.2.2",
+    "rfc4648": "^1.5.1"
   },
   "devDependencies": {
     "@cfworker/dev": "^1.14.0",

package/src/algs.ts

@@ -0,0 +1,7 @@
+export const algToHash: Record<string, string> = {
+  RS256: 'SHA-256',
+  RS384: 'SHA-384',
+  RS512: 'SHA-512'
+};
+
+export const algs = Object.keys(algToHash);

package/src/decode.ts

@@ -1,4 +1,4 @@
-import { decode } from '@cfworker/base64url';
+import { base64url } from 'rfc4648';
 import { DecodedJwt } from './types.js';
 
 /**
@@ -6,10 +6,15 @@ import { DecodedJwt } from './types.js';
  */
 export function decodeJwt(token: string): DecodedJwt {
   const [header, payload, signature] = token.split('.');
+  const decoder = new TextDecoder();
   return {
-    header: JSON.parse(decode(header)),
-    payload: JSON.parse(decode(payload)),
-    signature: decode(signature),
+    header: JSON.parse(
+      decoder.decode(base64url.parse(header, { loose: true }))
+    ),
+    payload: JSON.parse(
+      decoder.decode(base64url.parse(payload, { loose: true }))
+    ),
+    signature: base64url.parse(signature, { loose: true }),
     raw: { header, payload, signature }
   };
 }

package/src/jwks.ts

@@ -1,3 +1,4 @@
+import { algToHash } from './algs.js';
 import { DecodedJwt, JsonWebKeyset } from './types.js';
 
 /**
@@ -26,22 +27,22 @@ const importedKeys: Record<string, Record<string, CryptoKey>> = {};
  * @param jwks The JsonWebKeyset to import.
  */
 export async function importKey(iss: string, jwk: JsonWebKey) {
-  const input = {
-    kty: 'RSA',
-    e: 'AQAB',
-    n: jwk.n,
-    alg: 'RS256',
-    ext: true
-  };
+  if (jwk.kty !== 'RSA') {
+    throw new Error(`Unsupported jwk key type (kty) "${jwk.kty}".`);
+  }
+  const hash = jwk.alg ? algToHash[jwk.alg] : null;
+  if (!hash) {
+    throw new Error(`Unsupported jwk Algorithm (alg) "${jwk.alg}".`);
+  }
   const key = await crypto.subtle.importKey(
     'jwk',
-    input,
-    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+    jwk,
+    { name: 'RSASSA-PKCS1-v1_5', hash },
     false,
     ['verify']
   );
   importedKeys[iss] = importedKeys[iss] || {};
-  importedKeys[iss][jwk.kid || 'default'] = key;
+  importedKeys[iss][jwk.kid ?? 'default'] = key;
 }
 
 /**

package/src/parse.ts

@@ -1,3 +1,4 @@
+import { algs, algToHash } from './algs.js';
 import { decodeJwt } from './decode.js';
 import { getKey } from './jwks.js';
 import { DecodedJwt, JwtParseResult } from './types.js';
@@ -26,10 +27,10 @@ export async function parseJwt(
       reason: `Invalid JWT type "${decoded.header.typ}". Expected "JWT".`
     };
   }
-  if (decoded.header.alg !== 'RS256') {
+  if (!algToHash[decoded.header.alg]) {
     return {
       valid: false,
-      reason: `Invalid JWT algorithm "${decoded.header.alg}". Expected "RS256".`
+      reason: `Invalid JWT algorithm "${decoded.header.alg}". Supported: ${algs}.`
     };
   }
   if (

package/src/types.ts

@@ -28,7 +28,7 @@ export interface RawJwt {
 export interface DecodedJwt {
   header: JwtHeader;
   payload: JwtPayload;
-  signature: string;
+  signature: Uint8Array;
   raw: RawJwt;
 }
 

package/src/verify.ts

@@ -7,9 +7,11 @@ import { DecodedJwt } from './types.js';
 export async function verifyJwtSignature(decoded: DecodedJwt, key: CryptoKey) {
   const encoder = new TextEncoder();
   const data = encoder.encode(`${decoded.raw.header}.${decoded.raw.payload}`);
-  const signature = new Uint8Array(
-    Array.from(decoded.signature).map(c => c.charCodeAt(0))
-  );
 
-  return crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, data);
+  return crypto.subtle.verify(
+    'RSASSA-PKCS1-v1_5',
+    key,
+    decoded.signature,
+    data
+  );
 }