XS Advanced Container Security API for node.js. 

XS Advanced Container Security API for node.js

sap_extncrepos

@sap/xssec

All notable changes to this project will be documented in this file.

- update dependencies (e.g. axios 0 -> 1)

- add optional x5t validation (RFC 8705) for IAS tokens

- Restore support for disableCache flag for JWKS retrieval

- Bugfix for requests to XSUAA with array values inside form

- Support for app2service and app2app for IAS

- Fix IAS token exchange with X509 binding

- Send either both x-app_tid & x-client_id headers or none of them to IAS /certs endpoint to prevent bad request

- restore backward-compatibility feature: use cleanUpPemKey function on verification keys to support PEM with missing line breaks-

- restore backward-compatible behaviour: use verificationKey as fallback if KID is not found in JWKS but throw error about missing KID if it fails

- add app_tid to formular for token exchanges

- support for "x-app_tid" and "x-client-id" header for IAS cert endpoint

- bugfix for unknown variable in new cache implementation

- Replaced keycache implementation with new JwksReplica implementation: When a JWKS is used for validation, it is now checked if the cached replica will expire soon (default refresh period: 15min before expiration). If so, it will be refreshed in the background and the cached replica will still be used for validation until it has expired completely (default expiration time: 30min since last refresh). Validation of incoming requests will only be blocked by an expired JWKS if it could not be refreshed during the refresh period. Only one call at a time will be performed to refresh the JWKS.

- Addd support for resource-attribute for token flow/token exchange calls

- obfuscate credentials in debug output, when xssec:request debug variable is set

- hotfix: upgrade to newest jsonwebtoken version ^9.0.0 because of security issue complainings. But the library was never affected

- allow IAS issuer without https protocol prefix

- allow setting timeout without having credentials object provided

- hofix in keycache implementation if you turn off to use the cache

- add support for timeout setting for all requests-calls 

- support for password token flow in requests module

- support for setting scopes for all requests to XSUAA

- fix correlationID header names to "x-vcap-request-id" or "x-correlationid"

- support for "x-correlation-id" header to be set for createSecurityContext and tokenexchange-calls

- support to turn off the internal cache for a createSecurityContext call

- add additional getter for user properties on XSUAA context

- remove deed and unneeded code for IAS context

- fix token flows in requests if subdomain is provided using certificate

- replace got with axios library because of a bug in got lib during https get

- fix to be backward-compatible for tokenFlow-APIs

- fix an issue with IAS multitenancy support

- remove the deprecated request library with got library

- add checkFollowingInstanceScope to SecurityContext to retrieve instance specific scope without need to build scope string on your own

- fix a reference error in key verification

- support for multitenance IAS applications using 'x-zone_uuid' Header in jwks call

- Support for tokenexchanges with X.509 certificates managed by XSUAA

- Support for tokenexchanges with manually managed X.509 certificates

- support for configuration objects that does not provide a clientsecret (but a certificate)

- Add some more error and tracing information

- Support for IAS token validation. ([more details](doc/IAS.md))

- Feature: Support for IAS to XSUAA token exchange ([more details](doc/IAStoXSUAA.md))

- Feature: Support for ZoneID enabled token flows ([more details](doc/TokenFlows.md))

 * Authentication strategy for passport using JSON Web Token (JWT)

 * If JWT token is present and it is successfully verified, following objects are created:

 *  - request.user - according to http://passportjs.org/guide/profile/ convention

 *  - request.authInfo  - instance of xssec.SecurityContext

 *    - getHdbToken(...)   - retrieve token for business user to pass to HANA

 *    - checkScope(...) - authorization checks

 * See https://www.npmjs.com/package/passport

var debugTrace = debug('xssec:jwtstrategy');

var debugError = debug('xssec:jwtstrategy');

debugError.log = console.error.bind(console);

debugTrace.log = console.log.bind(console);

const { FWD_CLIENT_CERT_HEADER } = require('../constants');

function JWTStrategy(options, forceType) {

JWTStrategy.prototype.authenticate = function (req, options) {

  var authorization = req.headers.authorization;

    debugTrace('Missing Authorization header');

    req.tokenInfo = new SimpleError('Missing Authorization header');

    debugTrace('Invalid Authorization header format');

    req.tokenInfo = new SimpleError('Invalid Authorization header format');

  if (scheme.toLowerCase() !== 'bearer') {

    debugTrace('Authorization header is not a Bearer token');

    req.tokenInfo = new SimpleError('Authorization header is not a Bearer token');

  const correlationId = req.headers["x-correlationid"] || req.headers["x-vcap-request-id"];

  const x509Certificate = req.headers[FWD_CLIENT_CERT_HEADER];

    function callback(err, ctx, tokenInfo) {

        req.tokenInfo ??= new SimpleError(err.toString());

          req.tokenInfo = new SimpleError(err.toString());

        return err.statuscode ? self.fail(err.statuscode, err) : self.error(err);

      if (authParams && authParams.scope) {

        var scopes = Array.isArray(authParams.scope) ? authParams.scope : [authParams.scope];

          if (!ctx.checkScope(self.options.xsappname + '.' + scope)) {

      var jwtLogonName = ctx.getLogonName();

      var jwtGivenName = ctx.getGivenName();

      var jwtFamilyName = ctx.getFamilyName();

      // passport will set these in req.user & req.authInfo respectively

    var paramA = this._forceType ? this._forceType : callback;

    var paramB = this._forceType ? callback : undefined;

    const config = { ...options, credentials: this.options, correlationId };

      config.x509Certificate = x509Certificate;

    xssec.createSecurityContext(token, config, paramA, paramB);

    debugError('JWT verification error: ', err);

  "description": "XS Advanced Container Security API for node.js",

    "prepareRelease": "npm prune --production"

  "license": "SAP DEVELOPER LICENSE AGREEMENT",

		# Change Log
		All notable changes to this project will be documented in this file.

		## 3.6.1 - 2023-12-21
		- better support for older node versions

		## 3.6.0 - 2023-11-24
		@@ -5,0 +8,0 @@ - adapt optimized IAS server API

		@@ -81,3 +81,5 @@ 'use strict';
		if (err) {
		req.tokenInfo ??= new SimpleError(err.toString());
		if(!req.tokenInfo) {
		req.tokenInfo = new SimpleError(err.toString());
		}

		@@ -84,0 +86,0 @@ return err.statuscode ? self.fail(err.statuscode, err) : self.error(err);

		{
		"name": "@sap/xssec",
		"version": "3.6.0",
		"version": "3.6.1",
		"description": "XS Advanced Container Security API for node.js",
		@@ -24,3 +24,3 @@ "main": "./lib",
		"engines": {
		"node": ">=18"
		"node": ">=14"
		},
		@@ -27,0 +27,0 @@ "devDependencies": {

Improved metrics