jose 5.9.2 → 5.9.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -0
- package/dist/browser/jwks/remote.js +1 -1
- package/dist/browser/lib/jwt_claims_set.js +2 -1
- package/dist/browser/runtime/ecdhes.js +2 -1
- package/dist/browser/runtime/generate.js +1 -1
- package/dist/browser/util/errors.js +29 -64
- package/dist/node/cjs/jwks/remote.js +1 -1
- package/dist/node/cjs/lib/jwt_claims_set.js +2 -1
- package/dist/node/cjs/util/errors.js +34 -54
- package/dist/node/esm/jwks/remote.js +1 -1
- package/dist/node/esm/lib/jwt_claims_set.js +2 -1
- package/dist/node/esm/util/errors.js +34 -54
- package/dist/types/jwks/remote.d.ts +2 -2
- package/dist/types/jws/compact/verify.d.ts +1 -1
- package/dist/types/jws/flattened/verify.d.ts +1 -1
- package/dist/types/jws/general/verify.d.ts +1 -1
- package/dist/types/jwt/verify.d.ts +1 -1
- package/dist/types/key/export.d.ts +4 -4
- package/dist/types/key/generate_key_pair.d.ts +1 -2
- package/dist/types/key/generate_secret.d.ts +1 -2
- package/dist/types/key/import.d.ts +7 -8
- package/dist/types/types.d.ts +101 -84
- package/dist/types/util/base64url.d.ts +1 -1
- package/dist/types/util/errors.d.ts +39 -21
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,6 +2,16 @@
|
|
|
2
2
|
|
|
3
3
|
`jose` is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.
|
|
4
4
|
|
|
5
|
+
## Sponsor
|
|
6
|
+
|
|
7
|
+
<picture>
|
|
8
|
+
<source media="(prefers-color-scheme: dark)" srcset="./sponsor/Auth0byOkta_dark.png">
|
|
9
|
+
<source media="(prefers-color-scheme: light)" srcset="./sponsor/Auth0byOkta_light.png">
|
|
10
|
+
<img height="65" align="left" alt="Auth0 by Okta" src="./sponsor/Auth0byOkta_light.png">
|
|
11
|
+
</picture>
|
|
12
|
+
|
|
13
|
+
If you want to quickly add JWT authentication to JavaScript apps, feel free to check out Auth0's JavaScript SDK and free plan. [Create an Auth0 account; it's free!][sponsor-auth0]<br><br>
|
|
14
|
+
|
|
5
15
|
## [💗 Help the project](https://github.com/sponsors/panva)
|
|
6
16
|
|
|
7
17
|
Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
|
|
@@ -135,3 +145,5 @@ The algorithm implementations in `jose` have been tested using test vectors from
|
|
|
135
145
|
|
|
136
146
|
|
|
137
147
|
</details>
|
|
148
|
+
|
|
149
|
+
[sponsor-auth0]: https://auth0.com/signup?utm_source=external_sites&utm_medium=panva&utm_campaign=devn_signup
|
|
@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
|
|
|
10
10
|
let USER_AGENT;
|
|
11
11
|
if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
|
|
12
12
|
const NAME = 'jose';
|
|
13
|
-
const VERSION = 'v5.9.
|
|
13
|
+
const VERSION = 'v5.9.4';
|
|
14
14
|
USER_AGENT = `${NAME}/${VERSION}`;
|
|
15
15
|
}
|
|
16
16
|
export const jwksCache = Symbol();
|
|
@@ -44,7 +44,8 @@ export default (protectedHeader, encodedPayload, options = {}) => {
|
|
|
44
44
|
throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
|
|
45
45
|
}
|
|
46
46
|
}
|
|
47
|
-
if (issuer &&
|
|
47
|
+
if (issuer &&
|
|
48
|
+
!(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
|
|
48
49
|
throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
|
|
49
50
|
}
|
|
50
51
|
if (subject && payload.sub !== subject) {
|
|
@@ -22,7 +22,8 @@ export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu
|
|
|
22
22
|
}
|
|
23
23
|
else {
|
|
24
24
|
length =
|
|
25
|
-
Math.ceil(parseInt(publicKey.algorithm.namedCurve.substr(-3), 10) / 8) <<
|
|
25
|
+
Math.ceil(parseInt(publicKey.algorithm.namedCurve.substr(-3), 10) / 8) <<
|
|
26
|
+
3;
|
|
26
27
|
}
|
|
27
28
|
const sharedSecret = new Uint8Array(await crypto.subtle.deriveBits({
|
|
28
29
|
name: publicKey.algorithm.name,
|
|
@@ -135,5 +135,5 @@ export async function generateKeyPair(alg, options) {
|
|
|
135
135
|
default:
|
|
136
136
|
throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
|
|
137
137
|
}
|
|
138
|
-
return
|
|
138
|
+
return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
|
|
139
139
|
}
|
|
@@ -1,149 +1,114 @@
|
|
|
1
1
|
export class JOSEError extends Error {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
}
|
|
5
|
-
constructor(message) {
|
|
6
|
-
super(message);
|
|
2
|
+
constructor(message, options) {
|
|
3
|
+
super(message, options);
|
|
7
4
|
this.code = 'ERR_JOSE_GENERIC';
|
|
8
5
|
this.name = this.constructor.name;
|
|
9
6
|
Error.captureStackTrace?.(this, this.constructor);
|
|
10
7
|
}
|
|
11
8
|
}
|
|
9
|
+
JOSEError.code = 'ERR_JOSE_GENERIC';
|
|
12
10
|
export class JWTClaimValidationFailed extends JOSEError {
|
|
13
|
-
static get code() {
|
|
14
|
-
return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
15
|
-
}
|
|
16
11
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
17
|
-
super(message);
|
|
12
|
+
super(message, { cause: { claim, reason, payload } });
|
|
18
13
|
this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
19
14
|
this.claim = claim;
|
|
20
15
|
this.reason = reason;
|
|
21
16
|
this.payload = payload;
|
|
22
17
|
}
|
|
23
18
|
}
|
|
19
|
+
JWTClaimValidationFailed.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
24
20
|
export class JWTExpired extends JOSEError {
|
|
25
|
-
static get code() {
|
|
26
|
-
return 'ERR_JWT_EXPIRED';
|
|
27
|
-
}
|
|
28
21
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
29
|
-
super(message);
|
|
22
|
+
super(message, { cause: { claim, reason, payload } });
|
|
30
23
|
this.code = 'ERR_JWT_EXPIRED';
|
|
31
24
|
this.claim = claim;
|
|
32
25
|
this.reason = reason;
|
|
33
26
|
this.payload = payload;
|
|
34
27
|
}
|
|
35
28
|
}
|
|
29
|
+
JWTExpired.code = 'ERR_JWT_EXPIRED';
|
|
36
30
|
export class JOSEAlgNotAllowed extends JOSEError {
|
|
37
31
|
constructor() {
|
|
38
32
|
super(...arguments);
|
|
39
33
|
this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
40
34
|
}
|
|
41
|
-
static get code() {
|
|
42
|
-
return 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
43
|
-
}
|
|
44
35
|
}
|
|
36
|
+
JOSEAlgNotAllowed.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
45
37
|
export class JOSENotSupported extends JOSEError {
|
|
46
38
|
constructor() {
|
|
47
39
|
super(...arguments);
|
|
48
40
|
this.code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
49
41
|
}
|
|
50
|
-
static get code() {
|
|
51
|
-
return 'ERR_JOSE_NOT_SUPPORTED';
|
|
52
|
-
}
|
|
53
42
|
}
|
|
43
|
+
JOSENotSupported.code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
54
44
|
export class JWEDecryptionFailed extends JOSEError {
|
|
55
|
-
constructor() {
|
|
56
|
-
super(
|
|
45
|
+
constructor(message = 'decryption operation failed', options) {
|
|
46
|
+
super(message, options);
|
|
57
47
|
this.code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
58
|
-
this.message = 'decryption operation failed';
|
|
59
|
-
}
|
|
60
|
-
static get code() {
|
|
61
|
-
return 'ERR_JWE_DECRYPTION_FAILED';
|
|
62
48
|
}
|
|
63
49
|
}
|
|
50
|
+
JWEDecryptionFailed.code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
64
51
|
export class JWEInvalid extends JOSEError {
|
|
65
52
|
constructor() {
|
|
66
53
|
super(...arguments);
|
|
67
54
|
this.code = 'ERR_JWE_INVALID';
|
|
68
55
|
}
|
|
69
|
-
static get code() {
|
|
70
|
-
return 'ERR_JWE_INVALID';
|
|
71
|
-
}
|
|
72
56
|
}
|
|
57
|
+
JWEInvalid.code = 'ERR_JWE_INVALID';
|
|
73
58
|
export class JWSInvalid extends JOSEError {
|
|
74
59
|
constructor() {
|
|
75
60
|
super(...arguments);
|
|
76
61
|
this.code = 'ERR_JWS_INVALID';
|
|
77
62
|
}
|
|
78
|
-
static get code() {
|
|
79
|
-
return 'ERR_JWS_INVALID';
|
|
80
|
-
}
|
|
81
63
|
}
|
|
64
|
+
JWSInvalid.code = 'ERR_JWS_INVALID';
|
|
82
65
|
export class JWTInvalid extends JOSEError {
|
|
83
66
|
constructor() {
|
|
84
67
|
super(...arguments);
|
|
85
68
|
this.code = 'ERR_JWT_INVALID';
|
|
86
69
|
}
|
|
87
|
-
static get code() {
|
|
88
|
-
return 'ERR_JWT_INVALID';
|
|
89
|
-
}
|
|
90
70
|
}
|
|
71
|
+
JWTInvalid.code = 'ERR_JWT_INVALID';
|
|
91
72
|
export class JWKInvalid extends JOSEError {
|
|
92
73
|
constructor() {
|
|
93
74
|
super(...arguments);
|
|
94
75
|
this.code = 'ERR_JWK_INVALID';
|
|
95
76
|
}
|
|
96
|
-
static get code() {
|
|
97
|
-
return 'ERR_JWK_INVALID';
|
|
98
|
-
}
|
|
99
77
|
}
|
|
78
|
+
JWKInvalid.code = 'ERR_JWK_INVALID';
|
|
100
79
|
export class JWKSInvalid extends JOSEError {
|
|
101
80
|
constructor() {
|
|
102
81
|
super(...arguments);
|
|
103
82
|
this.code = 'ERR_JWKS_INVALID';
|
|
104
83
|
}
|
|
105
|
-
static get code() {
|
|
106
|
-
return 'ERR_JWKS_INVALID';
|
|
107
|
-
}
|
|
108
84
|
}
|
|
85
|
+
JWKSInvalid.code = 'ERR_JWKS_INVALID';
|
|
109
86
|
export class JWKSNoMatchingKey extends JOSEError {
|
|
110
|
-
constructor() {
|
|
111
|
-
super(
|
|
87
|
+
constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
|
|
88
|
+
super(message, options);
|
|
112
89
|
this.code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
113
|
-
this.message = 'no applicable key found in the JSON Web Key Set';
|
|
114
|
-
}
|
|
115
|
-
static get code() {
|
|
116
|
-
return 'ERR_JWKS_NO_MATCHING_KEY';
|
|
117
90
|
}
|
|
118
91
|
}
|
|
92
|
+
JWKSNoMatchingKey.code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
119
93
|
export class JWKSMultipleMatchingKeys extends JOSEError {
|
|
120
|
-
constructor() {
|
|
121
|
-
super(
|
|
94
|
+
constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
|
|
95
|
+
super(message, options);
|
|
122
96
|
this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
123
|
-
this.message = 'multiple matching keys found in the JSON Web Key Set';
|
|
124
|
-
}
|
|
125
|
-
static get code() {
|
|
126
|
-
return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
127
97
|
}
|
|
128
98
|
}
|
|
129
99
|
Symbol.asyncIterator;
|
|
100
|
+
JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
130
101
|
export class JWKSTimeout extends JOSEError {
|
|
131
|
-
constructor() {
|
|
132
|
-
super(
|
|
102
|
+
constructor(message = 'request timed out', options) {
|
|
103
|
+
super(message, options);
|
|
133
104
|
this.code = 'ERR_JWKS_TIMEOUT';
|
|
134
|
-
this.message = 'request timed out';
|
|
135
|
-
}
|
|
136
|
-
static get code() {
|
|
137
|
-
return 'ERR_JWKS_TIMEOUT';
|
|
138
105
|
}
|
|
139
106
|
}
|
|
107
|
+
JWKSTimeout.code = 'ERR_JWKS_TIMEOUT';
|
|
140
108
|
export class JWSSignatureVerificationFailed extends JOSEError {
|
|
141
|
-
constructor() {
|
|
142
|
-
super(
|
|
109
|
+
constructor(message = 'signature verification failed', options) {
|
|
110
|
+
super(message, options);
|
|
143
111
|
this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
144
|
-
this.message = 'signature verification failed';
|
|
145
|
-
}
|
|
146
|
-
static get code() {
|
|
147
|
-
return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
148
112
|
}
|
|
149
113
|
}
|
|
114
|
+
JWSSignatureVerificationFailed.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
@@ -13,7 +13,7 @@ function isCloudflareWorkers() {
|
|
|
13
13
|
let USER_AGENT;
|
|
14
14
|
if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
|
|
15
15
|
const NAME = 'jose';
|
|
16
|
-
const VERSION = 'v5.9.
|
|
16
|
+
const VERSION = 'v5.9.4';
|
|
17
17
|
USER_AGENT = `${NAME}/${VERSION}`;
|
|
18
18
|
}
|
|
19
19
|
exports.jwksCache = Symbol();
|
|
@@ -46,7 +46,8 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
|
|
|
46
46
|
throw new errors_js_1.JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
|
|
47
47
|
}
|
|
48
48
|
}
|
|
49
|
-
if (issuer &&
|
|
49
|
+
if (issuer &&
|
|
50
|
+
!(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
|
|
50
51
|
throw new errors_js_1.JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
|
|
51
52
|
}
|
|
52
53
|
if (subject && payload.sub !== subject) {
|
|
@@ -2,27 +2,23 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
|
|
4
4
|
class JOSEError extends Error {
|
|
5
|
-
static
|
|
6
|
-
return 'ERR_JOSE_GENERIC';
|
|
7
|
-
}
|
|
5
|
+
static code = 'ERR_JOSE_GENERIC';
|
|
8
6
|
code = 'ERR_JOSE_GENERIC';
|
|
9
|
-
constructor(message) {
|
|
10
|
-
super(message);
|
|
7
|
+
constructor(message, options) {
|
|
8
|
+
super(message, options);
|
|
11
9
|
this.name = this.constructor.name;
|
|
12
10
|
Error.captureStackTrace?.(this, this.constructor);
|
|
13
11
|
}
|
|
14
12
|
}
|
|
15
13
|
exports.JOSEError = JOSEError;
|
|
16
14
|
class JWTClaimValidationFailed extends JOSEError {
|
|
17
|
-
static
|
|
18
|
-
return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
19
|
-
}
|
|
15
|
+
static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
20
16
|
code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
21
17
|
claim;
|
|
22
18
|
reason;
|
|
23
19
|
payload;
|
|
24
20
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
25
|
-
super(message);
|
|
21
|
+
super(message, { cause: { claim, reason, payload } });
|
|
26
22
|
this.claim = claim;
|
|
27
23
|
this.reason = reason;
|
|
28
24
|
this.payload = payload;
|
|
@@ -30,15 +26,13 @@ class JWTClaimValidationFailed extends JOSEError {
|
|
|
30
26
|
}
|
|
31
27
|
exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
|
|
32
28
|
class JWTExpired extends JOSEError {
|
|
33
|
-
static
|
|
34
|
-
return 'ERR_JWT_EXPIRED';
|
|
35
|
-
}
|
|
29
|
+
static code = 'ERR_JWT_EXPIRED';
|
|
36
30
|
code = 'ERR_JWT_EXPIRED';
|
|
37
31
|
claim;
|
|
38
32
|
reason;
|
|
39
33
|
payload;
|
|
40
34
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
41
|
-
super(message);
|
|
35
|
+
super(message, { cause: { claim, reason, payload } });
|
|
42
36
|
this.claim = claim;
|
|
43
37
|
this.reason = reason;
|
|
44
38
|
this.payload = payload;
|
|
@@ -46,92 +40,78 @@ class JWTExpired extends JOSEError {
|
|
|
46
40
|
}
|
|
47
41
|
exports.JWTExpired = JWTExpired;
|
|
48
42
|
class JOSEAlgNotAllowed extends JOSEError {
|
|
49
|
-
static
|
|
50
|
-
return 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
51
|
-
}
|
|
43
|
+
static code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
52
44
|
code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
53
45
|
}
|
|
54
46
|
exports.JOSEAlgNotAllowed = JOSEAlgNotAllowed;
|
|
55
47
|
class JOSENotSupported extends JOSEError {
|
|
56
|
-
static
|
|
57
|
-
return 'ERR_JOSE_NOT_SUPPORTED';
|
|
58
|
-
}
|
|
48
|
+
static code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
59
49
|
code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
60
50
|
}
|
|
61
51
|
exports.JOSENotSupported = JOSENotSupported;
|
|
62
52
|
class JWEDecryptionFailed extends JOSEError {
|
|
63
|
-
static
|
|
64
|
-
return 'ERR_JWE_DECRYPTION_FAILED';
|
|
65
|
-
}
|
|
53
|
+
static code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
66
54
|
code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
67
|
-
message = 'decryption operation failed'
|
|
55
|
+
constructor(message = 'decryption operation failed', options) {
|
|
56
|
+
super(message, options);
|
|
57
|
+
}
|
|
68
58
|
}
|
|
69
59
|
exports.JWEDecryptionFailed = JWEDecryptionFailed;
|
|
70
60
|
class JWEInvalid extends JOSEError {
|
|
71
|
-
static
|
|
72
|
-
return 'ERR_JWE_INVALID';
|
|
73
|
-
}
|
|
61
|
+
static code = 'ERR_JWE_INVALID';
|
|
74
62
|
code = 'ERR_JWE_INVALID';
|
|
75
63
|
}
|
|
76
64
|
exports.JWEInvalid = JWEInvalid;
|
|
77
65
|
class JWSInvalid extends JOSEError {
|
|
78
|
-
static
|
|
79
|
-
return 'ERR_JWS_INVALID';
|
|
80
|
-
}
|
|
66
|
+
static code = 'ERR_JWS_INVALID';
|
|
81
67
|
code = 'ERR_JWS_INVALID';
|
|
82
68
|
}
|
|
83
69
|
exports.JWSInvalid = JWSInvalid;
|
|
84
70
|
class JWTInvalid extends JOSEError {
|
|
85
|
-
static
|
|
86
|
-
return 'ERR_JWT_INVALID';
|
|
87
|
-
}
|
|
71
|
+
static code = 'ERR_JWT_INVALID';
|
|
88
72
|
code = 'ERR_JWT_INVALID';
|
|
89
73
|
}
|
|
90
74
|
exports.JWTInvalid = JWTInvalid;
|
|
91
75
|
class JWKInvalid extends JOSEError {
|
|
92
|
-
static
|
|
93
|
-
return 'ERR_JWK_INVALID';
|
|
94
|
-
}
|
|
76
|
+
static code = 'ERR_JWK_INVALID';
|
|
95
77
|
code = 'ERR_JWK_INVALID';
|
|
96
78
|
}
|
|
97
79
|
exports.JWKInvalid = JWKInvalid;
|
|
98
80
|
class JWKSInvalid extends JOSEError {
|
|
99
|
-
static
|
|
100
|
-
return 'ERR_JWKS_INVALID';
|
|
101
|
-
}
|
|
81
|
+
static code = 'ERR_JWKS_INVALID';
|
|
102
82
|
code = 'ERR_JWKS_INVALID';
|
|
103
83
|
}
|
|
104
84
|
exports.JWKSInvalid = JWKSInvalid;
|
|
105
85
|
class JWKSNoMatchingKey extends JOSEError {
|
|
106
|
-
static
|
|
107
|
-
return 'ERR_JWKS_NO_MATCHING_KEY';
|
|
108
|
-
}
|
|
86
|
+
static code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
109
87
|
code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
110
|
-
message = 'no applicable key found in the JSON Web Key Set'
|
|
88
|
+
constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
|
|
89
|
+
super(message, options);
|
|
90
|
+
}
|
|
111
91
|
}
|
|
112
92
|
exports.JWKSNoMatchingKey = JWKSNoMatchingKey;
|
|
113
93
|
class JWKSMultipleMatchingKeys extends JOSEError {
|
|
114
94
|
[Symbol.asyncIterator];
|
|
115
|
-
static
|
|
116
|
-
return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
117
|
-
}
|
|
95
|
+
static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
118
96
|
code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
119
|
-
message = 'multiple matching keys found in the JSON Web Key Set'
|
|
97
|
+
constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
|
|
98
|
+
super(message, options);
|
|
99
|
+
}
|
|
120
100
|
}
|
|
121
101
|
exports.JWKSMultipleMatchingKeys = JWKSMultipleMatchingKeys;
|
|
122
102
|
class JWKSTimeout extends JOSEError {
|
|
123
|
-
static
|
|
124
|
-
return 'ERR_JWKS_TIMEOUT';
|
|
125
|
-
}
|
|
103
|
+
static code = 'ERR_JWKS_TIMEOUT';
|
|
126
104
|
code = 'ERR_JWKS_TIMEOUT';
|
|
127
|
-
message = 'request timed out'
|
|
105
|
+
constructor(message = 'request timed out', options) {
|
|
106
|
+
super(message, options);
|
|
107
|
+
}
|
|
128
108
|
}
|
|
129
109
|
exports.JWKSTimeout = JWKSTimeout;
|
|
130
110
|
class JWSSignatureVerificationFailed extends JOSEError {
|
|
131
|
-
static
|
|
132
|
-
return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
133
|
-
}
|
|
111
|
+
static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
134
112
|
code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
135
|
-
message = 'signature verification failed'
|
|
113
|
+
constructor(message = 'signature verification failed', options) {
|
|
114
|
+
super(message, options);
|
|
115
|
+
}
|
|
136
116
|
}
|
|
137
117
|
exports.JWSSignatureVerificationFailed = JWSSignatureVerificationFailed;
|
|
@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
|
|
|
10
10
|
let USER_AGENT;
|
|
11
11
|
if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
|
|
12
12
|
const NAME = 'jose';
|
|
13
|
-
const VERSION = 'v5.9.
|
|
13
|
+
const VERSION = 'v5.9.4';
|
|
14
14
|
USER_AGENT = `${NAME}/${VERSION}`;
|
|
15
15
|
}
|
|
16
16
|
export const jwksCache = Symbol();
|
|
@@ -44,7 +44,8 @@ export default (protectedHeader, encodedPayload, options = {}) => {
|
|
|
44
44
|
throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
|
|
45
45
|
}
|
|
46
46
|
}
|
|
47
|
-
if (issuer &&
|
|
47
|
+
if (issuer &&
|
|
48
|
+
!(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
|
|
48
49
|
throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
|
|
49
50
|
}
|
|
50
51
|
if (subject && payload.sub !== subject) {
|
|
@@ -1,119 +1,99 @@
|
|
|
1
1
|
export class JOSEError extends Error {
|
|
2
|
-
static
|
|
3
|
-
return 'ERR_JOSE_GENERIC';
|
|
4
|
-
}
|
|
2
|
+
static code = 'ERR_JOSE_GENERIC';
|
|
5
3
|
code = 'ERR_JOSE_GENERIC';
|
|
6
|
-
constructor(message) {
|
|
7
|
-
super(message);
|
|
4
|
+
constructor(message, options) {
|
|
5
|
+
super(message, options);
|
|
8
6
|
this.name = this.constructor.name;
|
|
9
7
|
Error.captureStackTrace?.(this, this.constructor);
|
|
10
8
|
}
|
|
11
9
|
}
|
|
12
10
|
export class JWTClaimValidationFailed extends JOSEError {
|
|
13
|
-
static
|
|
14
|
-
return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
15
|
-
}
|
|
11
|
+
static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
16
12
|
code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
17
13
|
claim;
|
|
18
14
|
reason;
|
|
19
15
|
payload;
|
|
20
16
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
21
|
-
super(message);
|
|
17
|
+
super(message, { cause: { claim, reason, payload } });
|
|
22
18
|
this.claim = claim;
|
|
23
19
|
this.reason = reason;
|
|
24
20
|
this.payload = payload;
|
|
25
21
|
}
|
|
26
22
|
}
|
|
27
23
|
export class JWTExpired extends JOSEError {
|
|
28
|
-
static
|
|
29
|
-
return 'ERR_JWT_EXPIRED';
|
|
30
|
-
}
|
|
24
|
+
static code = 'ERR_JWT_EXPIRED';
|
|
31
25
|
code = 'ERR_JWT_EXPIRED';
|
|
32
26
|
claim;
|
|
33
27
|
reason;
|
|
34
28
|
payload;
|
|
35
29
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
36
|
-
super(message);
|
|
30
|
+
super(message, { cause: { claim, reason, payload } });
|
|
37
31
|
this.claim = claim;
|
|
38
32
|
this.reason = reason;
|
|
39
33
|
this.payload = payload;
|
|
40
34
|
}
|
|
41
35
|
}
|
|
42
36
|
export class JOSEAlgNotAllowed extends JOSEError {
|
|
43
|
-
static
|
|
44
|
-
return 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
45
|
-
}
|
|
37
|
+
static code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
46
38
|
code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
47
39
|
}
|
|
48
40
|
export class JOSENotSupported extends JOSEError {
|
|
49
|
-
static
|
|
50
|
-
return 'ERR_JOSE_NOT_SUPPORTED';
|
|
51
|
-
}
|
|
41
|
+
static code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
52
42
|
code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
53
43
|
}
|
|
54
44
|
export class JWEDecryptionFailed extends JOSEError {
|
|
55
|
-
static
|
|
56
|
-
return 'ERR_JWE_DECRYPTION_FAILED';
|
|
57
|
-
}
|
|
45
|
+
static code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
58
46
|
code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
59
|
-
message = 'decryption operation failed'
|
|
47
|
+
constructor(message = 'decryption operation failed', options) {
|
|
48
|
+
super(message, options);
|
|
49
|
+
}
|
|
60
50
|
}
|
|
61
51
|
export class JWEInvalid extends JOSEError {
|
|
62
|
-
static
|
|
63
|
-
return 'ERR_JWE_INVALID';
|
|
64
|
-
}
|
|
52
|
+
static code = 'ERR_JWE_INVALID';
|
|
65
53
|
code = 'ERR_JWE_INVALID';
|
|
66
54
|
}
|
|
67
55
|
export class JWSInvalid extends JOSEError {
|
|
68
|
-
static
|
|
69
|
-
return 'ERR_JWS_INVALID';
|
|
70
|
-
}
|
|
56
|
+
static code = 'ERR_JWS_INVALID';
|
|
71
57
|
code = 'ERR_JWS_INVALID';
|
|
72
58
|
}
|
|
73
59
|
export class JWTInvalid extends JOSEError {
|
|
74
|
-
static
|
|
75
|
-
return 'ERR_JWT_INVALID';
|
|
76
|
-
}
|
|
60
|
+
static code = 'ERR_JWT_INVALID';
|
|
77
61
|
code = 'ERR_JWT_INVALID';
|
|
78
62
|
}
|
|
79
63
|
export class JWKInvalid extends JOSEError {
|
|
80
|
-
static
|
|
81
|
-
return 'ERR_JWK_INVALID';
|
|
82
|
-
}
|
|
64
|
+
static code = 'ERR_JWK_INVALID';
|
|
83
65
|
code = 'ERR_JWK_INVALID';
|
|
84
66
|
}
|
|
85
67
|
export class JWKSInvalid extends JOSEError {
|
|
86
|
-
static
|
|
87
|
-
return 'ERR_JWKS_INVALID';
|
|
88
|
-
}
|
|
68
|
+
static code = 'ERR_JWKS_INVALID';
|
|
89
69
|
code = 'ERR_JWKS_INVALID';
|
|
90
70
|
}
|
|
91
71
|
export class JWKSNoMatchingKey extends JOSEError {
|
|
92
|
-
static
|
|
93
|
-
return 'ERR_JWKS_NO_MATCHING_KEY';
|
|
94
|
-
}
|
|
72
|
+
static code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
95
73
|
code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
96
|
-
message = 'no applicable key found in the JSON Web Key Set'
|
|
74
|
+
constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
|
|
75
|
+
super(message, options);
|
|
76
|
+
}
|
|
97
77
|
}
|
|
98
78
|
export class JWKSMultipleMatchingKeys extends JOSEError {
|
|
99
79
|
[Symbol.asyncIterator];
|
|
100
|
-
static
|
|
101
|
-
return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
102
|
-
}
|
|
80
|
+
static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
103
81
|
code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
104
|
-
message = 'multiple matching keys found in the JSON Web Key Set'
|
|
82
|
+
constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
|
|
83
|
+
super(message, options);
|
|
84
|
+
}
|
|
105
85
|
}
|
|
106
86
|
export class JWKSTimeout extends JOSEError {
|
|
107
|
-
static
|
|
108
|
-
return 'ERR_JWKS_TIMEOUT';
|
|
109
|
-
}
|
|
87
|
+
static code = 'ERR_JWKS_TIMEOUT';
|
|
110
88
|
code = 'ERR_JWKS_TIMEOUT';
|
|
111
|
-
message = 'request timed out'
|
|
89
|
+
constructor(message = 'request timed out', options) {
|
|
90
|
+
super(message, options);
|
|
91
|
+
}
|
|
112
92
|
}
|
|
113
93
|
export class JWSSignatureVerificationFailed extends JOSEError {
|
|
114
|
-
static
|
|
115
|
-
return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
116
|
-
}
|
|
94
|
+
static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
117
95
|
code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
118
|
-
message = 'signature verification failed'
|
|
96
|
+
constructor(message = 'signature verification failed', options) {
|
|
97
|
+
super(message, options);
|
|
98
|
+
}
|
|
119
99
|
}
|
|
@@ -26,11 +26,11 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
|
|
|
26
26
|
* - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
|
|
27
27
|
* the object has changed.
|
|
28
28
|
*
|
|
29
|
-
* import * as jose from 'jose'
|
|
30
|
-
*
|
|
31
29
|
* // Prerequisites
|
|
32
30
|
* let url!: URL
|
|
33
31
|
* let jwt!: string
|
|
32
|
+
* let getPreviouslyCachedJWKS!: () => Promise<jose.ExportedJWKSCache>
|
|
33
|
+
* let storeNewJWKScache!: (cache: jose.ExportedJWKSCache) => Promise<void>
|
|
34
34
|
*
|
|
35
35
|
* // Load JSON Web Key Set cache
|
|
36
36
|
* const jwksCache: jose.JWKSCacheInput = (await getPreviouslyCachedJWKS()) || {}
|
|
@@ -3,7 +3,7 @@ import type { JWK, CompactVerifyResult, FlattenedJWSInput, GenericGetKeyFunction
|
|
|
3
3
|
* Interface for Compact JWS Verification dynamic key resolution. No token components have been
|
|
4
4
|
* verified at the time of this function call.
|
|
5
5
|
*
|
|
6
|
-
* @see
|
|
6
|
+
* @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
|
|
7
7
|
*/
|
|
8
8
|
export interface CompactVerifyGetKey extends GenericGetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
|
|
9
9
|
}
|
|
@@ -3,7 +3,7 @@ import type { JWK, FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderP
|
|
|
3
3
|
* Interface for Flattened JWS Verification dynamic key resolution. No token components have been
|
|
4
4
|
* verified at the time of this function call.
|
|
5
5
|
*
|
|
6
|
-
* @see
|
|
6
|
+
* @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
|
|
7
7
|
*/
|
|
8
8
|
export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
|
|
9
9
|
}
|
|
@@ -3,7 +3,7 @@ import type { JWK, GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, Gene
|
|
|
3
3
|
* Interface for General JWS Verification dynamic key resolution. No token components have been
|
|
4
4
|
* verified at the time of this function call.
|
|
5
5
|
*
|
|
6
|
-
* @see
|
|
6
|
+
* @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
|
|
7
7
|
*/
|
|
8
8
|
export interface GeneralVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
|
|
9
9
|
}
|
|
@@ -6,7 +6,7 @@ export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOpt
|
|
|
6
6
|
* Interface for JWT Verification dynamic key resolution. No token components have been verified at
|
|
7
7
|
* the time of this function call.
|
|
8
8
|
*
|
|
9
|
-
* @see
|
|
9
|
+
* @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
|
|
10
10
|
*/
|
|
11
11
|
export interface JWTVerifyGetKey extends GenericGetKeyFunction<JWTHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
|
|
12
12
|
}
|