shelving 1.150.3 → 1.150.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/util/jwt.js +6 -6
package/package.json
CHANGED
package/util/jwt.js
CHANGED
|
@@ -2,13 +2,13 @@ import { UnauthorizedError } from "../error/RequestError.js";
|
|
|
2
2
|
import { ValueError } from "../error/ValueError.js";
|
|
3
3
|
import { decodeBase64URLBytes, decodeBase64URLString, encodeBase64URL } from "./base64.js";
|
|
4
4
|
import { getBytes, requireBytes } from "./bytes.js";
|
|
5
|
-
import { DAY } from "./constants.js";
|
|
5
|
+
import { DAY, MINUTE, SECOND } from "./constants.js";
|
|
6
6
|
// Constants.
|
|
7
7
|
const HASH = "SHA-512";
|
|
8
8
|
const ALGORITHM = { name: "HMAC", hash: HASH };
|
|
9
9
|
const HEADER = { alg: "HS512", typ: "JWT" };
|
|
10
10
|
const EXPIRY_MS = DAY * 10;
|
|
11
|
-
const SKEW_MS =
|
|
11
|
+
const SKEW_MS = MINUTE; // Allow 1 minute clock skew.
|
|
12
12
|
const SECRET_BYTES = 64; // Minimum 64 bytes / 512 bits
|
|
13
13
|
function _getKey(caller, secret, ...usages) {
|
|
14
14
|
const bytes = getBytes(secret);
|
|
@@ -94,12 +94,12 @@ export async function verifyToken(token, secret, caller = verifyToken) {
|
|
|
94
94
|
throw new UnauthorizedError("JWT signature does not match", { received: token, caller });
|
|
95
95
|
// Validate payload.
|
|
96
96
|
const { nbf, iat, exp } = payloadData;
|
|
97
|
-
const now =
|
|
98
|
-
if (typeof nbf === "number" &&
|
|
97
|
+
const now = Date.now();
|
|
98
|
+
if (typeof nbf === "number" && now < nbf * SECOND - SKEW_MS)
|
|
99
99
|
throw new UnauthorizedError("JWT cannot be used yet", { received: payloadData, expected: now, caller });
|
|
100
|
-
if (typeof iat === "number" && iat
|
|
100
|
+
if (typeof iat === "number" && now < iat * SECOND - SKEW_MS)
|
|
101
101
|
throw new UnauthorizedError("JWT not issued yet", { received: payloadData, expected: now, caller });
|
|
102
|
-
if (typeof exp === "number" && exp
|
|
102
|
+
if (typeof exp === "number" && now > exp * SECOND + SKEW_MS)
|
|
103
103
|
throw new UnauthorizedError("JWT has expired", { received: payloadData, expected: now, caller });
|
|
104
104
|
return payloadData;
|
|
105
105
|
}
|