joye-backend-utility 7.4.1 → 8.0.0

package/dist/jwt.js

@@ -7,6 +7,7 @@ const path = require('path');
 const folderPath = path.resolve(`${__dirname}`);
 const JWT_PRIVATE_KEY = fs.readFileSync(`${folderPath}/jwtKeys/jwtRS256.key`, 'utf8');
 const JWT_PUBLIC_KEY = fs.readFileSync(`${folderPath}/jwtKeys/jwtRS256.key.pub`, 'utf8');
+const ALLOWED_JWT_ALGORITHMS = ['RS256'];
 const createToken = async (payload, expiresIn) => {
     const token = jwt.sign(payload, { key: JWT_PRIVATE_KEY.replace(/\\n/gm, '\n'), passphrase: process.env.JWT_SECRET }, {
         expiresIn,
@@ -16,7 +17,12 @@ const createToken = async (payload, expiresIn) => {
 };
 exports.createToken = createToken;
 const jwtVerify = async (token) => new Promise(resolve => {
-    jwt.verify(token, JWT_PUBLIC_KEY.replace(/\\n/gm, '\n'), async (err, decoded) => {
+    var _a;
+    const decodedHeader = jwt.decode(token, { complete: true });
+    if (!((_a = decodedHeader === null || decodedHeader === void 0 ? void 0 : decodedHeader.header) === null || _a === void 0 ? void 0 : _a.alg) || decodedHeader.header.alg === 'none') {
+        return resolve(new Error('Invalid token algorithm'));
+    }
+    jwt.verify(token, JWT_PUBLIC_KEY.replace(/\\n/gm, '\n'), { algorithms: ALLOWED_JWT_ALGORITHMS }, async (err, decoded) => {
         if (err) {
             return resolve(err);
         }

package/dist/tests/jwtAlgorithmValidation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/jwtAlgorithmValidation.test.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = require("assert");
+const jwt = require('jsonwebtoken');
+const jwt_1 = require("../jwt");
+const run = async () => {
+    const payload = {
+        userId: 'security-test-user',
+        email: 'security-test@example.com',
+    };
+    const noneToken = jwt.sign(payload, null, { algorithm: 'none' });
+    const noneResult = await (0, jwt_1.jwtVerify)(noneToken);
+    assert.ok(noneResult instanceof Error, 'Expected alg=none token to be rejected');
+    const hsToken = jwt.sign(payload, 'not-rs256-key', { algorithm: 'HS256' });
+    const hsResult = await (0, jwt_1.jwtVerify)(hsToken);
+    assert.ok(hsResult instanceof Error, 'Expected HS256 token to be rejected');
+    console.log('JWT algorithm validation tests passed.');
+};
+run().catch(error => {
+    console.error('JWT algorithm validation tests failed:', error);
+    process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "joye-backend-utility",
-  "version": "7.4.1",
+  "version": "8.0.0",
   "description": "Joye backend utility for db functions and common functions",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,6 +13,7 @@
   "scripts": {
     "build": "tsc && yarn copy-files",
     "test": "echo \"Error: no test specified\"",
+    "test:jwt-algorithm": "ts-node lib/tests/jwtAlgorithmValidation.test.ts",
     "postinstall": "npm run build",
     "lint": "eslint --ignore-path .gitignore --ext .ts .",
     "lint:fix": "npm run lint -- --fix",