@naturalcycles/nodejs-lib 15.121.0 → 15.121.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/jwt/jwt.service.js
CHANGED
|
@@ -182,9 +182,11 @@ export class JWTService {
|
|
|
182
182
|
if (err instanceof errors.JOSEError) {
|
|
183
183
|
return new JWTInvalidError(err.message, errorData);
|
|
184
184
|
}
|
|
185
|
-
if (this.cfg.verifyAlgorithms && err instanceof TypeError) {
|
|
185
|
+
if (this.cfg.verifyAlgorithms && (err instanceof TypeError || err instanceof DOMException)) {
|
|
186
186
|
// With multiple verifyAlgorithms, a token/key algorithm mismatch is reachable
|
|
187
|
-
// by untrusted input, and jose reports it as TypeError
|
|
187
|
+
// by untrusted input, and jose reports it as TypeError, or (since jose 6.2.6,
|
|
188
|
+
// which prepares keys via Node's KeyObject.toCryptoKey) as DOMException
|
|
189
|
+
// "DataError: Invalid key type" - treat it as an invalid token
|
|
188
190
|
return new JWTInvalidError(err.message, errorData);
|
|
189
191
|
}
|
|
190
192
|
return err;
|
package/package.json
CHANGED
package/src/jwt/jwt.service.ts
CHANGED
|
@@ -379,9 +379,11 @@ export class JWTService<T extends AnyObject = AnyObject> {
|
|
|
379
379
|
if (err instanceof errors.JOSEError) {
|
|
380
380
|
return new JWTInvalidError(err.message, errorData)
|
|
381
381
|
}
|
|
382
|
-
if (this.cfg.verifyAlgorithms && err instanceof TypeError) {
|
|
382
|
+
if (this.cfg.verifyAlgorithms && (err instanceof TypeError || err instanceof DOMException)) {
|
|
383
383
|
// With multiple verifyAlgorithms, a token/key algorithm mismatch is reachable
|
|
384
|
-
// by untrusted input, and jose reports it as TypeError
|
|
384
|
+
// by untrusted input, and jose reports it as TypeError, or (since jose 6.2.6,
|
|
385
|
+
// which prepares keys via Node's KeyObject.toCryptoKey) as DOMException
|
|
386
|
+
// "DataError: Invalid key type" - treat it as an invalid token
|
|
385
387
|
return new JWTInvalidError(err.message, errorData)
|
|
386
388
|
}
|
|
387
389
|
return err as Error
|