@cfworker/jwt 2.0.0 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/parse.d.ts +2 -2
  2. package/dist/parse.js +83 -19
  3. package/dist/types.d.ts +2 -0
  4. package/package.json +1 -1
  5. package/src/parse.ts +109 -24
  6. package/src/types.ts +2 -0
package/dist/parse.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- import { JwtParseResult } from './types.js';
2
- export declare function parseJwt(encodedToken: string, issuer: string, audience: string): Promise<JwtParseResult>;
1
+ import { DecodedJwt, JwtParseResult } from './types.js';
2
+ export declare function parseJwt(encodedToken: string, issuer: string, audience: string, resolveKey?: (decoded: DecodedJwt) => Promise<CryptoKey | null>): Promise<JwtParseResult>;
package/dist/parse.js CHANGED
@@ -2,7 +2,8 @@ import { algs, algToHash } from './algs.js';
2
2
  import { decodeJwt } from './decode.js';
3
3
  import { getKey } from './jwks.js';
4
4
  import { verifyJwtSignature } from './verify.js';
5
- export async function parseJwt(encodedToken, issuer, audience) {
5
+ const skewMs = 30 * 1000;
6
+ export async function parseJwt(encodedToken, issuer, audience, resolveKey = getKey) {
6
7
  let decoded;
7
8
  try {
8
9
  decoded = decodeJwt(encodedToken);
@@ -10,57 +11,120 @@ export async function parseJwt(encodedToken, issuer, audience) {
10
11
  catch {
11
12
  return { valid: false, reason: `Unable to decode JWT.` };
12
13
  }
13
- if (typeof decoded.header.typ !== 'undefined' &&
14
- decoded.header.typ !== 'JWT') {
14
+ const { typ, alg } = decoded.header;
15
+ if (typeof typ !== 'undefined' && typ !== 'JWT') {
15
16
  return {
16
17
  valid: false,
17
- reason: `Invalid JWT type "${decoded.header.typ}". Expected "JWT".`
18
+ reason: `Invalid JWT type ${JSON.stringify(typ)}. Expected "JWT".`
18
19
  };
19
20
  }
20
- if (!algToHash[decoded.header.alg]) {
21
+ if (!algToHash[alg]) {
21
22
  return {
22
23
  valid: false,
23
- reason: `Invalid JWT algorithm "${decoded.header.alg}". Supported: ${algs}.`
24
+ reason: `Invalid JWT algorithm ${JSON.stringify(alg)}. Supported: ${algs}.`
24
25
  };
25
26
  }
26
- if (typeof decoded.payload.aud === 'string' &&
27
- decoded.payload.aud !== audience) {
27
+ const { sub, aud, iss, iat, exp, nbf } = decoded.payload;
28
+ if (typeof sub !== 'string') {
28
29
  return {
29
30
  valid: false,
30
- reason: `Invalid JWT audience "${decoded.payload.aud}". Expected "${audience}".`
31
+ reason: `Subject claim (sub) is required and must be a string. Received ${JSON.stringify(sub)}.`
31
32
  };
32
33
  }
33
- else if (Array.isArray(decoded.payload.aud) &&
34
- !decoded.payload.aud.includes(audience)) {
34
+ if (typeof aud === 'string') {
35
+ if (aud !== audience) {
36
+ return {
37
+ valid: false,
38
+ reason: `Invalid JWT audience claim (aud) ${JSON.stringify(aud)}. Expected "${audience}".`
39
+ };
40
+ }
41
+ }
42
+ else if (Array.isArray(aud) &&
43
+ aud.length > 0 &&
44
+ aud.every(a => typeof a === 'string')) {
45
+ if (!aud.includes(audience)) {
46
+ return {
47
+ valid: false,
48
+ reason: `Invalid JWT audience claim array (aud) ${JSON.stringify(aud)}. Does not include "${audience}".`
49
+ };
50
+ }
51
+ }
52
+ else {
35
53
  return {
36
54
  valid: false,
37
- reason: `Invalid JWT audience in array "${decoded.payload.aud}". Does not include "${audience}".`
55
+ reason: `Invalid JWT audience claim (aud) ${JSON.stringify(aud)}. Expected a string or a non-empty array of strings.`
38
56
  };
39
57
  }
40
- if (decoded.payload.iss !== issuer) {
58
+ if (iss !== issuer) {
41
59
  return {
42
60
  valid: false,
43
- reason: `Invalid JWT issuer "${decoded.payload.iss}". Expected "${issuer}".`
61
+ reason: `Invalid JWT issuer claim (iss) ${JSON.stringify(decoded.payload.iss)}. Expected "${issuer}".`
62
+ };
63
+ }
64
+ if (typeof exp !== 'number') {
65
+ return {
66
+ valid: false,
67
+ reason: `Invalid JWT expiry date claim (exp) ${JSON.stringify(exp)}. Expected number.`
44
68
  };
45
69
  }
46
- const expiryDate = new Date(0);
47
- expiryDate.setUTCSeconds(decoded.payload.exp);
48
70
  const currentDate = new Date(Date.now());
49
- const expired = expiryDate <= currentDate;
71
+ const expiryDate = new Date(0);
72
+ expiryDate.setUTCSeconds(exp);
73
+ const expired = expiryDate.getTime() <= currentDate.getTime() - skewMs;
50
74
  if (expired) {
51
75
  return {
52
76
  valid: false,
53
77
  reason: `JWT is expired. Expiry date: ${expiryDate}; Current date: ${currentDate};`
54
78
  };
55
79
  }
80
+ if (nbf !== undefined) {
81
+ if (typeof nbf !== 'number') {
82
+ return {
83
+ valid: false,
84
+ reason: `Invalid JWT not before date claim (nbf) ${JSON.stringify(nbf)}. Expected number.`
85
+ };
86
+ }
87
+ const notBeforeDate = new Date(0);
88
+ notBeforeDate.setUTCSeconds(nbf);
89
+ const early = notBeforeDate.getTime() > currentDate.getTime() + skewMs;
90
+ if (early) {
91
+ return {
92
+ valid: false,
93
+ reason: `JWT cannot be used prior to not before date claim (nbf). Not before date: ${notBeforeDate}; Current date: ${currentDate};`
94
+ };
95
+ }
96
+ }
97
+ if (iat !== undefined) {
98
+ if (typeof iat !== 'number') {
99
+ return {
100
+ valid: false,
101
+ reason: `Invalid JWT issued at date claim (iat) ${JSON.stringify(iat)}. Expected number.`
102
+ };
103
+ }
104
+ const issuedAtDate = new Date(0);
105
+ issuedAtDate.setUTCSeconds(iat);
106
+ const postIssued = issuedAtDate.getTime() > currentDate.getTime() + skewMs;
107
+ if (postIssued) {
108
+ return {
109
+ valid: false,
110
+ reason: `JWT issued at date claim (iat) is in the future. Issued at date: ${issuedAtDate}; Current date: ${currentDate};`
111
+ };
112
+ }
113
+ }
56
114
  let key;
57
115
  try {
58
- key = await getKey(decoded);
116
+ key = await resolveKey(decoded);
59
117
  }
60
118
  catch {
61
119
  return {
62
120
  valid: false,
63
- reason: `Error retrieving key to verify JWT signature.`
121
+ reason: `Error retrieving public key to verify JWT signature.`
122
+ };
123
+ }
124
+ if (!key) {
125
+ return {
126
+ valid: false,
127
+ reason: `Unable to resolve public key to verify JWT signature.`
64
128
  };
65
129
  }
66
130
  let signatureValid;
package/dist/types.d.ts CHANGED
@@ -4,6 +4,8 @@ export interface JwtPayload {
4
4
  aud: string | Array<string>;
5
5
  iat: number;
6
6
  exp: number;
7
+ nbf?: number;
8
+ jti?: string;
7
9
  }
8
10
  export interface JwtHeader {
9
11
  typ?: string;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cfworker/jwt",
3
- "version": "2.0.0",
3
+ "version": "3.0.0",
4
4
  "description": "Tiny lib for decoding JWTs and verifying signatures, using native crypto APIs",
5
5
  "keywords": [
6
6
  "jwt",
package/src/parse.ts CHANGED
@@ -4,13 +4,16 @@ import { getKey } from './jwks.js';
4
4
  import { DecodedJwt, JwtParseResult } from './types.js';
5
5
  import { verifyJwtSignature } from './verify.js';
6
6
 
7
+ const skewMs = 30 * 1000;
8
+
7
9
  /**
8
10
  * Parse a JWT.
9
11
  */
10
12
  export async function parseJwt(
11
13
  encodedToken: string,
12
14
  issuer: string,
13
- audience: string
15
+ audience: string,
16
+ resolveKey: (decoded: DecodedJwt) => Promise<CryptoKey | null> = getKey
14
17
  ): Promise<JwtParseResult> {
15
18
  let decoded: DecodedJwt;
16
19
  try {
@@ -18,62 +21,144 @@ export async function parseJwt(
18
21
  } catch {
19
22
  return { valid: false, reason: `Unable to decode JWT.` };
20
23
  }
21
- if (
22
- typeof decoded.header.typ !== 'undefined' &&
23
- decoded.header.typ !== 'JWT'
24
- ) {
24
+ const { typ, alg } = decoded.header;
25
+ if (typeof typ !== 'undefined' && typ !== 'JWT') {
25
26
  return {
26
27
  valid: false,
27
- reason: `Invalid JWT type "${decoded.header.typ}". Expected "JWT".`
28
+ reason: `Invalid JWT type ${JSON.stringify(typ)}. Expected "JWT".`
28
29
  };
29
30
  }
30
- if (!algToHash[decoded.header.alg]) {
31
+ if (!algToHash[alg]) {
31
32
  return {
32
33
  valid: false,
33
- reason: `Invalid JWT algorithm "${decoded.header.alg}". Supported: ${algs}.`
34
+ reason: `Invalid JWT algorithm ${JSON.stringify(
35
+ alg
36
+ )}. Supported: ${algs}.`
34
37
  };
35
38
  }
36
- if (
37
- typeof decoded.payload.aud === 'string' &&
38
- decoded.payload.aud !== audience
39
- ) {
39
+
40
+ const { sub, aud, iss, iat, exp, nbf } = decoded.payload;
41
+ if (typeof sub !== 'string') {
40
42
  return {
41
43
  valid: false,
42
- reason: `Invalid JWT audience "${decoded.payload.aud}". Expected "${audience}".`
44
+ reason: `Subject claim (sub) is required and must be a string. Received ${JSON.stringify(
45
+ sub
46
+ )}.`
43
47
  };
48
+ }
49
+
50
+ if (typeof aud === 'string') {
51
+ if (aud !== audience) {
52
+ return {
53
+ valid: false,
54
+ reason: `Invalid JWT audience claim (aud) ${JSON.stringify(
55
+ aud
56
+ )}. Expected "${audience}".`
57
+ };
58
+ }
44
59
  } else if (
45
- Array.isArray(decoded.payload.aud) &&
46
- !decoded.payload.aud.includes(audience)
60
+ Array.isArray(aud) &&
61
+ aud.length > 0 &&
62
+ aud.every(a => typeof a === 'string')
47
63
  ) {
64
+ if (!aud.includes(audience)) {
65
+ return {
66
+ valid: false,
67
+ reason: `Invalid JWT audience claim array (aud) ${JSON.stringify(
68
+ aud
69
+ )}. Does not include "${audience}".`
70
+ };
71
+ }
72
+ } else {
48
73
  return {
49
74
  valid: false,
50
- reason: `Invalid JWT audience in array "${decoded.payload.aud}". Does not include "${audience}".`
75
+ reason: `Invalid JWT audience claim (aud) ${JSON.stringify(
76
+ aud
77
+ )}. Expected a string or a non-empty array of strings.`
51
78
  };
52
79
  }
53
80
 
54
- if (decoded.payload.iss !== issuer) {
81
+ if (iss !== issuer) {
55
82
  return {
56
83
  valid: false,
57
- reason: `Invalid JWT issuer "${decoded.payload.iss}". Expected "${issuer}".`
84
+ reason: `Invalid JWT issuer claim (iss) ${JSON.stringify(
85
+ decoded.payload.iss
86
+ )}. Expected "${issuer}".`
87
+ };
88
+ }
89
+
90
+ if (typeof exp !== 'number') {
91
+ return {
92
+ valid: false,
93
+ reason: `Invalid JWT expiry date claim (exp) ${JSON.stringify(
94
+ exp
95
+ )}. Expected number.`
58
96
  };
59
97
  }
60
- const expiryDate = new Date(0);
61
- expiryDate.setUTCSeconds(decoded.payload.exp);
62
98
  const currentDate = new Date(Date.now());
63
- const expired = expiryDate <= currentDate;
99
+ const expiryDate = new Date(0);
100
+ expiryDate.setUTCSeconds(exp);
101
+ const expired = expiryDate.getTime() <= currentDate.getTime() - skewMs;
64
102
  if (expired) {
65
103
  return {
66
104
  valid: false,
67
105
  reason: `JWT is expired. Expiry date: ${expiryDate}; Current date: ${currentDate};`
68
106
  };
69
107
  }
70
- let key: CryptoKey;
108
+
109
+ if (nbf !== undefined) {
110
+ if (typeof nbf !== 'number') {
111
+ return {
112
+ valid: false,
113
+ reason: `Invalid JWT not before date claim (nbf) ${JSON.stringify(
114
+ nbf
115
+ )}. Expected number.`
116
+ };
117
+ }
118
+ const notBeforeDate = new Date(0);
119
+ notBeforeDate.setUTCSeconds(nbf);
120
+ const early = notBeforeDate.getTime() > currentDate.getTime() + skewMs;
121
+ if (early) {
122
+ return {
123
+ valid: false,
124
+ reason: `JWT cannot be used prior to not before date claim (nbf). Not before date: ${notBeforeDate}; Current date: ${currentDate};`
125
+ };
126
+ }
127
+ }
128
+
129
+ if (iat !== undefined) {
130
+ if (typeof iat !== 'number') {
131
+ return {
132
+ valid: false,
133
+ reason: `Invalid JWT issued at date claim (iat) ${JSON.stringify(
134
+ iat
135
+ )}. Expected number.`
136
+ };
137
+ }
138
+ const issuedAtDate = new Date(0);
139
+ issuedAtDate.setUTCSeconds(iat);
140
+ const postIssued = issuedAtDate.getTime() > currentDate.getTime() + skewMs;
141
+ if (postIssued) {
142
+ return {
143
+ valid: false,
144
+ reason: `JWT issued at date claim (iat) is in the future. Issued at date: ${issuedAtDate}; Current date: ${currentDate};`
145
+ };
146
+ }
147
+ }
148
+
149
+ let key: CryptoKey | null;
71
150
  try {
72
- key = await getKey(decoded);
151
+ key = await resolveKey(decoded);
73
152
  } catch {
74
153
  return {
75
154
  valid: false,
76
- reason: `Error retrieving key to verify JWT signature.`
155
+ reason: `Error retrieving public key to verify JWT signature.`
156
+ };
157
+ }
158
+ if (!key) {
159
+ return {
160
+ valid: false,
161
+ reason: `Unable to resolve public key to verify JWT signature.`
77
162
  };
78
163
  }
79
164
  let signatureValid: boolean;
package/src/types.ts CHANGED
@@ -4,6 +4,8 @@ export interface JwtPayload {
4
4
  aud: string | Array<string>;
5
5
  iat: number;
6
6
  exp: number;
7
+ nbf?: number;
8
+ jti?: string;
7
9
  }
8
10
 
9
11
  export interface JwtHeader {