get-jwks - npm Package Compare versions

Comparing version 8.2.0 to 8.3.0

package.json

 {
   "name": "get-jwks",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "description": "Fetch utils for JWKS keys",
@@ -5,0 +5,0 @@ "main": "src/get-jwks.js",

README.md

@@ -25,3 +25,6 @@ # get-jwks
   timeout: 5000,
-  allowedDomains: ['https://example.com'],
+  issuersWhitelist: ['https://example.com'],
+  checkIssuer: (issuer) => {
+    return issuer === 'https://example.com'
+  },
   providerDiscovery: false,
@@ -37,3 +40,5 @@ agent: new https.Agent({
 - `timeout`: Specifies how long it should wait to retrieve a JWK before it fails. The time is set in milliseconds. Defaults to 5s.
-- `allowedDomains`: Array of allowed domains. By default all domains are allowed.
+- `issuersWhitelist`: Array of allowed issuers. By default all issuers are allowed.
+- `allowedDomains`: This has been **deprecated** and replaced with `issuersWhitelist`.
+- `checkIssuer`: Optional user defined function to validate a token's domain.
 - `providerDiscovery`: Indicates if the Provider Configuration Information is used to automatically get the jwks_uri from the [OpenID Provider Discovery Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig). This endpoint is exposing the [Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). With this flag set to true the domain will be treated as the OpenID Issuer which is the iss property in the token. Defaults to false. Ignored if jwksPath is specified.
@@ -133,3 +138,3 @@ - `jwksPath`: Specify a relative path to the jwks_uri. Example `/otherdir/jwks.json`. Takes precedence over providerDiscovery. Optional.
 
-const getJwks = buildGetJwks({ allowedDomains: [...]})
+const getJwks = buildGetJwks({ issuersWhitelist: [...]})
 
@@ -136,0 +141,0 @@ // create a verifier function with key as a function

src/get-jwks.d.ts

@@ -16,3 +16,3 @@ import type { LRUCache } from 'lru-cache'
   ttl?: number
-  allowedDomains?: string[]
+  issuersWhitelist?: string[]
   providerDiscovery?: boolean
@@ -19,0 +19,0 @@ jwksPath?: string

src/get-jwks.js

@@ -21,3 +21,4 @@ 'use strict'
   const timeout = options.timeout || 5 * 1000 /* 5 seconds */
-  const allowedDomains = (options.allowedDomains || []).map(ensureTrailingSlash)
+  const issuersWhitelist = (options.issuersWhitelist || options.allowedDomains || []).map(ensureTrailingSlash)
+  const checkIssuer = options.checkIssuer
   const providerDiscovery = options.providerDiscovery || false
@@ -68,3 +69,3 @@ const jwksPath = options.jwksPath
 
-    if (allowedDomains.length && !allowedDomains.includes(normalizedDomain)) {
+    if (issuersWhitelist.length && !issuersWhitelist.includes(normalizedDomain)) {
       const error = new GetJwksError(errorCode.DOMAIN_NOT_ALLOWED)
@@ -74,2 +75,7 @@ return Promise.reject(error)
 
+    if (checkIssuer && !checkIssuer(normalizedDomain)) {
+      const error = new GetJwksError(errorCode.DOMAIN_NOT_ALLOWED)
+      return Promise.reject(error)
+    }
+
     const cacheKey = `${alg}:${kid}:${normalizedDomain}`
@@ -76,0 +82,0 @@ const cachedJwk = cache.get(cacheKey)

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

13997

increased by3.65%

Lines of code

191

increased by2.69%

Number of lines in readme file

152

increased by3.4%

No dependency changes