Research
Recent Trends in Malicious Packages Targeting Discord
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.
@nestjs/jwt
Advanced tools
Readme
A progressive Node.js framework for building efficient and scalable server-side applications.
JWT utilities module for Nest based on the jsonwebtoken package.
$ npm i --save @nestjs/jwt
Import JwtModule
:
@Module({
imports: [JwtModule.register({ secret: 'hard!to-guess_secret' })],
providers: [...],
})
export class AuthModule {}
Inject JwtService
:
@Injectable()
export class AuthService {
constructor(private readonly jwtService: JwtService) {}
}
If you want to control secret and key management dynamically you can use the secretOrKeyProvider
function for that purpose. You also can use asynchronous version of secretOrKeyProvider
.
NOTE: For asynchronous version of secretOrKeyProvider
, synchronous versions of .sign()
and .verify()
will throw an exception.
JwtModule.register({
/* Secret has precedence over keys */
secret: 'hard!to-guess_secret',
/* public key used in asymmetric algorithms (required if non other secrets present) */
publicKey: '...',
/* private key used in asymmetric algorithms (required if non other secrets present) */
privateKey: '...',
/* Dynamic key provider has precedence over static secret or pub/private keys */
secretOrKeyProvider: (
requestType: JwtSecretRequestType,
tokenOrPayload: string | Object | Buffer,
verifyOrSignOrOptions?: jwt.VerifyOptions | jwt.SignOptions
) => {
switch (requestType) {
case JwtSecretRequestType.SIGN:
// retrieve signing key dynamically
return 'privateKey';
case JwtSecretRequestType.VERIFY:
// retrieve public key for verification dynamically
return 'publicKey';
default:
// retrieve secret dynamically
return 'hard!to-guess_secret';
}
},
});
Quite often you might want to asynchronously pass your module options instead of passing them beforehand. In such case, use registerAsync()
method, that provides a couple of various ways to deal with async data.
1. Use factory
JwtModule.registerAsync({
useFactory: () => ({
secret: 'hard!to-guess_secret'
})
});
Obviously, our factory behaves like every other one (might be async
and is able to inject dependencies through inject
).
JwtModule.registerAsync({
imports: [ConfigModule],
useFactory: async (configService: ConfigService) => ({
secret: configService.get<string>('SECRET'),
}),
inject: [ConfigService],
}),
2. Use class
JwtModule.registerAsync({
useClass: JwtConfigService
});
Above construction will instantiate JwtConfigService
inside JwtModule
and will leverage it to create options object.
class JwtConfigService implements JwtOptionsFactory {
createJwtOptions(): JwtModuleOptions {
return {
secret: 'hard!to-guess_secret'
};
}
}
3. Use existing
JwtModule.registerAsync({
imports: [ConfigModule],
useExisting: ConfigService,
}),
It works the same as useClass
with one critical difference - JwtModule
will lookup imported modules to reuse already created ConfigService
, instead of instantiating it on its own.
The JwtService
uses jsonwebtoken underneath.
The sign method is an implementation of jsonwebtoken .sign()
. Differing from jsonwebtoken it also allows an additional secret
, privateKey
, and publicKey
properties on options
to override options passed in from the module. It only overrides the secret
, publicKey
or privateKey
though not a secretOrKeyProvider
.
NOTE: Will throw an exception for asynchronous version of secretOrKeyProvider
;
The asynchronous .sign()
method.
The verify method is an implementation of jsonwebtoken .verify()
. Differing from jsonwebtoken it also allows an additional secret
, privateKey
, and publicKey
properties on options
to override options passed in from the module. It only overrides the secret
, publicKey
or privateKey
though not a secretOrKeyProvider
.
NOTE: Will throw an exception for asynchronous version of secretOrKeyProvider
;
The asynchronous .verify()
method.
The decode method is an implementation of jsonwebtoken .decode()
.
The JwtModule
takes an options
object:
secret
is either a string, buffer, or object containing the secret for HMAC algorithmssecretOrKeyProvider
function with the following signature (requestType, tokenOrPayload, options?) => jwt.Secret | Promise<jwt.Secret>
(allows generating either secrets or keys dynamically)signOptions
read moreprivateKey
PEM encoded private key for RSA and ECDSA with passphrase an object { key, passphrase }
read morepublicKey
PEM encoded public key for RSA and ECDSAverifyOptions
read moresecretOrPrivateKey
(DEPRECATED!) read moreNest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please read more here.
Nest is MIT licensed.
FAQs
Nest - modern, fast, powerful node.js web framework (@jwt)
We found that @nestjs/jwt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.
Security News
Socket CEO Feross Aboukhadijeh joins a16z partners to discuss how modern, sophisticated supply chain attacks require AI-driven defenses and explore the challenges and solutions in leveraging AI for threat detection early in the development life cycle.
Security News
NIST's new AI Risk Management Framework aims to enhance the security and reliability of generative AI systems and address the unique challenges of malicious AI exploits.