Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
idtoken-verifier
Advanced tools
A lightweight library to decode and verify RS JWT meant for the browser.
The idtoken-verifier npm package is used to verify ID tokens, typically in the context of authentication and authorization. It helps ensure that the tokens are valid, properly signed, and not tampered with.
Verify ID Token
This feature allows you to verify the validity of an ID token. You need to provide the issuer and audience information, and then use the `verify` method to check the token. If the token is valid, the payload is returned; otherwise, an error is provided.
const IdTokenVerifier = require('idtoken-verifier');
const verifier = new IdTokenVerifier({
issuer: 'https://your-issuer.com/',
audience: 'your-audience'
});
const token = 'your-id-token';
verifier.verify(token, (err, payload) => {
if (err) {
console.error('Token verification failed:', err);
} else {
console.log('Token is valid. Payload:', payload);
}
});
Decode ID Token
This feature allows you to decode an ID token without verifying it. The `decode` method returns the decoded token, which can be useful for inspecting the token's contents.
const IdTokenVerifier = require('idtoken-verifier');
const token = 'your-id-token';
const decoded = IdTokenVerifier.decode(token);
console.log('Decoded token:', decoded);
The jsonwebtoken package is a popular library for working with JSON Web Tokens (JWTs). It provides functionalities for signing, verifying, and decoding tokens. Compared to idtoken-verifier, jsonwebtoken offers a broader range of features for handling JWTs, including token creation.
The jose package is a comprehensive library for JSON Web Algorithms (JWA), JSON Web Keys (JWK), JSON Web Signatures (JWS), and JSON Web Encryption (JWE). It provides extensive support for various cryptographic operations related to JWTs. While idtoken-verifier focuses on verifying ID tokens, jose offers a more extensive set of tools for working with JWTs and related standards.
The passport-jwt package is a Passport strategy for authenticating with JSON Web Tokens. It is used in conjunction with the Passport authentication middleware for Node.js. This package is more focused on integrating JWT authentication into web applications, whereas idtoken-verifier is specifically for verifying ID tokens.
A lightweight library to decode and verify RS JWT meant for the browser.
import IdTokenVerifier from 'idtoken-verifier';
const verifier = new IdTokenVerifier({
issuer: 'https://my.auth0.com/',
audience: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt'
});
verifier.verify(id_token, nonce, (error, payload) => {
...
});
var decoded = verifier.decode(id_token);
Initializes the verifier.
Parameters:
/.well-known/jwks.json
endpoint (or jwksURI
if provided) each time it verifies a token. You can provide a cache to store the keys and avoid repeated requests. For the contract, check this example. Hint: for in-memory cache, an easy way is to just provide new Map()
, which is a valid object for jwksCache.${id_token.iss}/.well-known/jwks.json
This method will decode the token, verify the issuer, audience, expiration, algorithm and nonce claims and after that will verify the token signature.
Parameters
This method will decode the token header and payload WITHOUT doing any verification.
Parameters
Return
To make it as lightweight as posible, it only provides support for RS256 tokens. It can be easily extensible to other RS* algorithms.
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
A lightweight library to decode and verify RS JWT meant for the browser.
The npm package idtoken-verifier receives a total of 177,593 weekly downloads. As such, idtoken-verifier popularity was classified as popular.
We found that idtoken-verifier demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.