openid-client 3.14.1 → 3.15.2

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [3.15.2](https://github.com/panva/node-openid-client/compare/v3.15.1...v3.15.2) (2020-06-01)
+
+
+### Bug Fixes
+
+* allow any JSON numeric value for timestamp values ([a24a759](https://github.com/panva/node-openid-client/commit/a24a7596c038bacd5bdbfc5b8678a96e62b86fd2)), closes [#263](https://github.com/panva/node-openid-client/issues/263)
+
+
+
+## [3.15.1](https://github.com/panva/node-openid-client/compare/v3.15.0...v3.15.1) (2020-05-12)
+
+
+### Bug Fixes
+
+* A192CBC-HS384 and A256CBC-HS512 direct encryption key derivation ([c356bbe](https://github.com/panva/node-openid-client/commit/c356bbeaba1e28b6a56534b9ba503cb536c14d57))
+
+
+
+# [3.15.0](https://github.com/panva/node-openid-client/compare/v3.14.2...v3.15.0) (2020-04-28)
+
+
+### Features
+
+* add RPError indicators for unix timestamp comparison failures ([fe3db5c](https://github.com/panva/node-openid-client/commit/fe3db5c46a04cab024901782f202d08234b4cd96)), closes [#250](https://github.com/panva/node-openid-client/issues/250)
+
+
+
+## [3.14.2](https://github.com/panva/node-openid-client/compare/v3.14.1...v3.14.2) (2020-04-07)
+
+
+### Bug Fixes
+
+* **typescript:** add options arg to TypeOfGenericClient ([b97b028](https://github.com/panva/node-openid-client/commit/b97b0288d5d79f25cad3d0009212878c5d42a2e0))
+
+
+
 ## [3.14.1](https://github.com/panva/node-openid-client/compare/v3.14.0...v3.14.1) (2020-03-21)
 
 

package/lib/client.js

@@ -711,9 +711,9 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
           jwt: idToken,
         });
       }
-      if (!Number.isInteger(payload.auth_time)) {
+      if (typeof payload.auth_time !== 'number') {
         throw new RPError({
-          message: 'JWT auth_time claim must be a JSON number integer',
+          message: 'JWT auth_time claim must be a JSON numeric value',
           jwt: idToken,
         });
       }
@@ -722,6 +722,9 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
     if (maxAge && (payload.auth_time + maxAge < timestamp - this[CLOCK_TOLERANCE])) {
       throw new RPError({
         printf: ['too much time has elapsed since the last End-User authentication, max_age %i, auth_time: %i, now %i', maxAge, payload.auth_time, timestamp - this[CLOCK_TOLERANCE]],
+        now: timestamp,
+        tolerance: this[CLOCK_TOLERANCE],
+        auth_time: payload.auth_time,
         jwt: idToken,
       });
     }
@@ -754,6 +757,9 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
         if (payload.iat < timestamp - 3600) {
           throw new RPError({
             printf: ['JWT issued too far in the past, now %i, iat %i', timestamp, payload.iat],
+            now: timestamp,
+            tolerance: this[CLOCK_TOLERANCE],
+            iat: payload.iat,
             jwt: idToken,
           });
         }
@@ -846,39 +852,45 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
     }
 
     if (payload.iat !== undefined) {
-      if (!Number.isInteger(payload.iat)) {
+      if (typeof payload.iat !== 'number') {
         throw new RPError({
-          message: 'JWT iat claim must be a JSON number integer',
+          message: 'JWT iat claim must be a JSON numeric value',
           jwt,
         });
       }
     }
 
     if (payload.nbf !== undefined) {
-      if (!Number.isInteger(payload.nbf)) {
+      if (typeof payload.nbf !== 'number') {
         throw new RPError({
-          message: 'JWT nbf claim must be a JSON number integer',
+          message: 'JWT nbf claim must be a JSON numeric value',
           jwt,
         });
       }
       if (payload.nbf > timestamp + this[CLOCK_TOLERANCE]) {
         throw new RPError({
           printf: ['JWT not active yet, now %i, nbf %i', timestamp + this[CLOCK_TOLERANCE], payload.nbf],
+          now: timestamp,
+          tolerance: this[CLOCK_TOLERANCE],
+          nbf: payload.nbf,
           jwt,
         });
       }
     }
 
     if (payload.exp !== undefined) {
-      if (!Number.isInteger(payload.exp)) {
+      if (typeof payload.exp !== 'number') {
         throw new RPError({
-          message: 'JWT exp claim must be a JSON number integer',
+          message: 'JWT exp claim must be a JSON numeric value',
           jwt,
         });
       }
       if (timestamp - this[CLOCK_TOLERANCE] >= payload.exp) {
         throw new RPError({
           printf: ['JWT expired, now %i, exp %i', timestamp - this[CLOCK_TOLERANCE], payload.exp],
+          now: timestamp,
+          tolerance: this[CLOCK_TOLERANCE],
+          exp: payload.exp,
           jwt,
         });
       }
@@ -1179,7 +1191,12 @@ module.exports = (issuer, aadIssValidation = false) => class Client extends Base
       return instance(this).get(cacheKey);
     }
 
-    const derivedBuffer = crypto.createHash('sha256')
+    const hash = len <= 256 ? 'sha256' : len <= 384 ? 'sha384' : len <= 512 ? 'sha512' : false; // eslint-disable-line no-nested-ternary
+    if (!hash) {
+      throw new Error('unsupported symmetric encryption key derivation');
+    }
+
+    const derivedBuffer = crypto.createHash(hash)
       .update(this.client_secret)
       .digest()
       .slice(0, len / 8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client",
-  "version": "3.14.1",
+  "version": "3.15.2",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
   "keywords": [
     "auth",
@@ -44,7 +44,7 @@
     "@types/got": "^9.6.9",
     "base64url": "^3.0.1",
     "got": "^9.6.0",
-    "jose": "^1.25.0",
+    "jose": "^1.27.1",
     "lodash": "^4.17.15",
     "lru-cache": "^5.1.1",
     "make-error": "^1.3.6",

package/types/index.d.ts

@@ -507,7 +507,7 @@ export interface MtlsEndpointAliases {
 // https://stackoverflow.com/questions/39622778/what-is-new-in-typescript
 // https://github.com/Microsoft/TypeScript/issues/204
 export interface TypeOfGenericClient<TClient extends Client> {
-  new (metadata: ClientMetadata, jwks?: JSONWebKeySet): TClient;
+  new (metadata: ClientMetadata, jwks?: JSONWebKeySet, options?: ClientOptions): TClient;
   [custom.http_options]: CustomHttpOptionsProvider;
   [custom.clock_tolerance]: number;
 }
@@ -779,5 +779,11 @@ export namespace errors {
      * from got.
      */
     response?: any;
+    now?: number;
+    tolerance?: number;
+    nbf?: number;
+    exp?: number;
+    iat?: number;
+    auth_time?: number;
   }
 }