jose 1.27.3 → 1.28.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+# [1.28.0](https://github.com/panva/jose/compare/v1.27.3...v1.28.0) (2020-08-10)
+
+
+### Features
+
+* support for validating issuer from a list of values ([#91](https://github.com/panva/jose/issues/91)) ([ce6836a](https://github.com/panva/jose/commit/ce6836af88c9e73c29560233f15ed1760c7dcc13))
+
+
+
 ## [1.27.3](https://github.com/panva/jose/compare/v1.27.2...v1.27.3) (2020-08-04)
 
 

package/lib/jwe/encrypt.js

@@ -190,7 +190,11 @@ class Encrypt {
     let aad
     if (this._aad) {
       final.aad = base64url.encode(this._aad)
-      aad = Buffer.concat([Buffer.from(final.protected || ''), Buffer.from('.'), Buffer.from(final.aad)])
+      aad = Buffer.concat([
+        Buffer.from(final.protected || ''),
+        Buffer.from('.'),
+        Buffer.from(final.aad)
+      ])
     } else {
       aad = Buffer.from(final.protected || '')
     }

package/lib/jws/sign.js

@@ -87,26 +87,21 @@ class Sign {
     recipient.header = unprotectedHeader
     recipient.protected = Object.keys(joseHeader.protected).length ? base64url.JSON.encode(joseHeader.protected) : ''
 
-    let toBeSigned
-    if (joseHeader.protected.crit && joseHeader.protected.crit.includes('b64')) {
-      if (first && !joseHeader.protected.b64) {
-        if (this._binary) {
-          this._payload = base64url.decodeToBuffer(this._payload)
-        } else {
-          this._payload = base64url.decode(this._payload)
-        }
+    if (first && joseHeader.protected.crit && joseHeader.protected.crit.includes('b64') && joseHeader.protected.b64 === false) {
+      if (this._binary) {
+        this._payload = base64url.decodeToBuffer(this._payload)
+      } else {
+        this._payload = base64url.decode(this._payload)
       }
-
-      toBeSigned = Buffer.concat([
-        Buffer.from(recipient.protected || ''),
-        Buffer.from('.'),
-        Buffer.isBuffer(this._payload) ? this._payload : Buffer.from(this._payload)
-      ])
-    } else {
-      toBeSigned = `${recipient.protected || ''}.${this._payload}`
     }
 
-    recipient.signature = base64url.encodeBuffer(sign(alg, key, toBeSigned))
+    const data = Buffer.concat([
+      Buffer.from(recipient.protected || ''),
+      Buffer.from('.'),
+      Buffer.from(this._payload)
+    ])
+
+    recipient.signature = base64url.encodeBuffer(sign(alg, key, data))
   }
 
   /*

package/lib/jwt/verify.js

@@ -63,12 +63,15 @@ const validateOptions = ({
 
   isOptionString(maxTokenAge, 'options.maxTokenAge')
   isOptionString(subject, 'options.subject')
-  isOptionString(issuer, 'options.issuer')
   isOptionString(maxAuthAge, 'options.maxAuthAge')
   isOptionString(jti, 'options.jti')
   isOptionString(clockTolerance, 'options.clockTolerance')
   isOptionString(typ, 'options.typ')
 
+  if (issuer !== undefined && (isNotString(issuer) && isNotArrayOfStrings(issuer))) {
+    throw new TypeError('options.issuer must be a string or an array of strings')
+  }
+
   if (audience !== undefined && (isNotString(audience) && isNotArrayOfStrings(audience))) {
     throw new TypeError('options.audience must be a string or an array of strings')
   }
@@ -161,7 +164,7 @@ const validateTypes = ({ header, payload }, profile, options) => {
   isPayloadString(payload.jti, '"jti" claim', 'jti', profile === LOGOUTTOKEN || profile === ATJWT || !!options.jti)
   isPayloadString(payload.acr, '"acr" claim', 'acr')
   isPayloadString(payload.nonce, '"nonce" claim', 'nonce', !!options.nonce)
-  isPayloadString(payload.iss, '"iss" claim', 'iss', !!options.issuer)
+  isStringOrArrayOfStrings(payload.iss, 'iss', !!options.issuer)
   isPayloadString(payload.sub, '"sub" claim', 'sub', profile === IDTOKEN || profile === ATJWT || !!options.subject)
   isStringOrArrayOfStrings(payload.aud, 'aud', !!options.audience)
   isPayloadString(payload.azp, '"azp" claim', 'azp', profile === IDTOKEN && Array.isArray(payload.aud) && payload.aud.length > 1)
@@ -235,7 +238,7 @@ module.exports = (token, key, options = {}) => {
   const unix = epoch(now)
   validateTypes(decoded, profile, options)
 
-  if (issuer && decoded.payload.iss !== issuer) {
+  if (issuer && (typeof decoded.payload.iss !== 'string' || !(typeof issuer === 'string' ? [issuer] : issuer).includes(decoded.payload.iss))) {
     throw new JWTClaimInvalid('unexpected "iss" claim value', 'iss', 'check_failed')
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "1.27.3",
+  "version": "1.28.0",
   "description": "JSON Web Almost Everything - JWA, JWS, JWE, JWK, JWT, JWKS for Node.js with minimal dependencies",
   "keywords": [
     "access token",

package/types/index.d.ts

@@ -444,7 +444,7 @@ export namespace JWT {
     ignoreIat?: boolean;
     maxTokenAge?: string;
     subject?: string;
-    issuer?: string;
+    issuer?: string | string[];
     maxAuthAge?: string;
     jti?: string;
     clockTolerance?: string;
@@ -479,7 +479,7 @@ export namespace JWT {
   function sign(payload: object, key: ProduceKeyInputWithNone, options?: SignOptions): string;
 
   interface VerifyProfileOptions<profile> {
-    issuer: string;
+    issuer: string | string[];
     audience: string | string[];
     profile?: profile;
   }