@cfworker/jwt 4.0.5 → 5.0.0

package/README.md

@@ -15,7 +15,7 @@ const jwt = request.headers.get('Authorization');
 const issuer = '...'; // Auth0 origin.
 const audience = '...'; // Auth0 client id.
 
-const result = await parseJwt(jwt, issuer, audience);
+const result = await parseJwt({ jwt, issuer, audience });
 if (!result.valid) {
   console.log(result.reason); // Invalid issuer/audience, expired, etc
 } else {

package/dist/parse.d.ts

@@ -1,2 +1,9 @@
 import { DecodedJwt, JwtParseResult } from './types.js';
-export declare function parseJwt(encodedToken: string, issuer: string, audience: string, resolveKey?: (decoded: DecodedJwt) => Promise<CryptoKey | null>): Promise<JwtParseResult>;
+export interface JwtParseOptions {
+    jwt: string;
+    issuer: string | string[];
+    audience: string;
+    resolveKey?: (decoded: DecodedJwt) => Promise<CryptoKey | null>;
+    skewMs?: number;
+}
+export declare function parseJwt({ jwt, issuer, audience, resolveKey, skewMs }: JwtParseOptions): Promise<JwtParseResult>;

package/dist/parse.js

@@ -2,11 +2,11 @@ import { algs, algToHash } from './algs.js';
 import { decodeJwt } from './decode.js';
 import { getKey } from './jwks.js';
 import { verifyJwtSignature } from './verify.js';
-const skewMs = 30 * 1000;
-export async function parseJwt(encodedToken, issuer, audience, resolveKey = getKey) {
+const defaultSkewMs = 60 * 1000;
+export async function parseJwt({ jwt, issuer, audience, resolveKey = getKey, skewMs = defaultSkewMs }) {
     let decoded;
     try {
-        decoded = decodeJwt(encodedToken);
+        decoded = decodeJwt(jwt);
     }
     catch {
         return { valid: false, reason: `Unable to decode JWT.` };
@@ -55,10 +55,10 @@ export async function parseJwt(encodedToken, issuer, audience, resolveKey = getK
             reason: `Invalid JWT audience claim (aud) ${JSON.stringify(aud)}. Expected a string or a non-empty array of strings.`
         };
     }
-    if (iss !== issuer) {
+    if (!(iss === issuer || (Array.isArray(issuer) && issuer.includes(iss)))) {
         return {
             valid: false,
-            reason: `Invalid JWT issuer claim (iss) ${JSON.stringify(decoded.payload.iss)}. Expected "${issuer}".`
+            reason: `Invalid JWT issuer claim (iss) ${JSON.stringify(decoded.payload.iss)}. Expected ${JSON.stringify(issuer)}.`
         };
     }
     if (typeof exp !== 'number') {
@@ -137,6 +137,6 @@ export async function parseJwt(encodedToken, issuer, audience, resolveKey = getK
     if (!signatureValid) {
         return { valid: false, reason: `JWT signature is invalid.` };
     }
-    const payload = decoded.payload;
-    return { valid: true, payload };
+    const { header, payload } = decoded;
+    return { valid: true, header, payload };
 }

package/dist/types.d.ts

@@ -29,6 +29,7 @@ export interface JsonWebKeyset {
 }
 export interface ValidJwtParseResult {
     valid: true;
+    header: JwtHeader;
     payload: JwtPayload;
 }
 export interface InvalidJwtParseResult {
@@ -61,4 +62,4 @@ export interface MtlsEndpointAliases {
     introspection_endpoint?: string;
     device_authorization_endpoint?: string;
 }
-export declare type JwtParseResult = ValidJwtParseResult | InvalidJwtParseResult;
+export type JwtParseResult = ValidJwtParseResult | InvalidJwtParseResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cfworker/jwt",
-  "version": "4.0.5",
+  "version": "5.0.0",
   "description": "Tiny lib for decoding JWTs and verifying signatures, using native crypto APIs",
   "keywords": [
     "jwt",
@@ -31,19 +31,19 @@
   "scripts": {
     "build": "tsc --build",
     "clean": "tsc --build --clean",
-    "test": "cfworker test test/**/*.spec.ts --nocheck"
+    "pretest": "esbuild test/test.ts --target=esnext --bundle --format=esm --conditions=worker,browser --outdir=dist-test --ignore-annotations",
+    "test": "node ../../test.mjs"
   },
   "dependencies": {
-    "@cfworker/worker-types": "^1.12.3",
-    "@cloudflare/workers-types": "^2.2.2",
-    "rfc4648": "^1.5.2"
+    "rfc4648": "^1.5.3"
   },
   "devDependencies": {
-    "@cfworker/dev": "^1.14.2",
-    "@types/chai": "^4.3.3",
-    "@types/mocha": "^10.0.0",
-    "chai": "^4.3.6",
-    "mocha": "^10.0.0",
-    "typescript": "^4.8.4"
+    "@types/chai": "^4.3.17",
+    "@types/mocha": "^10.0.7",
+    "chai": "^5.1.1",
+    "esbuild": "^0.23.1",
+    "mocha": "^10.7.3",
+    "typescript": "^5.5.4",
+    "wrangler": "^3.72.0"
   }
 }

package/src/declarations.d.ts

@@ -0,0 +1,6 @@
+interface JsonWebKey {
+  x5c?: string[];
+  kid?: string;
+  x5t?: string;
+  n?: string;
+}

package/src/parse.ts

@@ -4,20 +4,55 @@ import { getKey } from './jwks.js';
 import { DecodedJwt, JwtParseResult } from './types.js';
 import { verifyJwtSignature } from './verify.js';
 
-const skewMs = 30 * 1000;
+const defaultSkewMs = 60 * 1000;
+
+export interface JwtParseOptions {
+  /**
+   * The JWT to parse.
+   */
+  jwt: string;
+
+  /**
+   * Permitted issuer(s) of the JWT. Used to validate the iss claim.
+   * Note: if you're using the default resolveKey function, OIDC discovery will be used
+   * to fetch the public key(s) for the issuer.
+   */
+  issuer: string | string[];
+
+  /**
+   * Expected audience of the JWT.
+   */
+  audience: string;
+
+  /**
+   * Given a decoded (but not fully verified) JWT, resolve the public key that
+   * should be used to verify the signature. Typical implementations will use
+   * the "kid" claim to look up the key in a JWKS endpoint or other key store.
+   * If the key cannot be resolved, the function should return null.
+   * @param decoded The decoded (but not fully verified / unsafe) JWT.
+   */
+  resolveKey?: (decoded: DecodedJwt) => Promise<CryptoKey | null>;
+
+  /**
+   * The maximum skew in milliseconds to allow when validating iat, nbf, and exp claims.
+   * Defaults to 60 seconds.
+   */
+  skewMs?: number;
+}
 
 /**
  * Parse a JWT.
  */
-export async function parseJwt(
-  encodedToken: string,
-  issuer: string,
-  audience: string,
-  resolveKey: (decoded: DecodedJwt) => Promise<CryptoKey | null> = getKey
-): Promise<JwtParseResult> {
+export async function parseJwt({
+  jwt,
+  issuer,
+  audience,
+  resolveKey = getKey,
+  skewMs = defaultSkewMs
+}: JwtParseOptions): Promise<JwtParseResult> {
   let decoded: DecodedJwt;
   try {
-    decoded = decodeJwt(encodedToken);
+    decoded = decodeJwt(jwt);
   } catch {
     return { valid: false, reason: `Unable to decode JWT.` };
   }
@@ -78,12 +113,12 @@ export async function parseJwt(
     };
   }
 
-  if (iss !== issuer) {
+  if (!(iss === issuer || (Array.isArray(issuer) && issuer.includes(iss)))) {
     return {
       valid: false,
       reason: `Invalid JWT issuer claim (iss) ${JSON.stringify(
         decoded.payload.iss
-      )}. Expected "${issuer}".`
+      )}. Expected ${JSON.stringify(issuer)}.`
     };
   }
 
@@ -172,6 +207,6 @@ export async function parseJwt(
   if (!signatureValid) {
     return { valid: false, reason: `JWT signature is invalid.` };
   }
-  const payload = decoded.payload;
-  return { valid: true, payload };
+  const { header, payload } = decoded;
+  return { valid: true, header, payload };
 }

package/src/types.ts

@@ -41,6 +41,7 @@ export interface JsonWebKeyset {
 
 export interface ValidJwtParseResult {
   valid: true;
+  header: JwtHeader;
   payload: JwtPayload;
 }
 

package/tsconfig.json

@@ -1,17 +1,11 @@
 {
   "extends": "../../tsconfig-base",
   "compilerOptions": {
-    "target": "ES2021",
+    "target": "ESNext",
     "lib": ["ESNext", "WebWorker", "Webworker.Iterable"],
-    "types": [
-      "chai",
-      "mocha",
-      "@cfworker/worker-types",
-      "@cloudflare/workers-types"
-    ],
     "outDir": "dist",
     "rootDir": "./src"
   },
   "include": ["src"],
-  "references": [{ "path": "../base64url" }]
+  "references": []
 }