Security News
NIST Misses 2024 Deadline to Clear NVD Backlog
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.
idtoken-verifier
Advanced tools
A lightweight library to decode and verify RS JWT meant for the browser.
The idtoken-verifier npm package is used to verify ID tokens, typically in the context of authentication and authorization. It helps ensure that the tokens are valid, properly signed, and not tampered with.
Verify ID Token
This feature allows you to verify the validity of an ID token. You need to provide the issuer and audience information, and then use the `verify` method to check the token. If the token is valid, the payload is returned; otherwise, an error is provided.
const IdTokenVerifier = require('idtoken-verifier');
const verifier = new IdTokenVerifier({
issuer: 'https://your-issuer.com/',
audience: 'your-audience'
});
const token = 'your-id-token';
verifier.verify(token, (err, payload) => {
if (err) {
console.error('Token verification failed:', err);
} else {
console.log('Token is valid. Payload:', payload);
}
});
Decode ID Token
This feature allows you to decode an ID token without verifying it. The `decode` method returns the decoded token, which can be useful for inspecting the token's contents.
const IdTokenVerifier = require('idtoken-verifier');
const token = 'your-id-token';
const decoded = IdTokenVerifier.decode(token);
console.log('Decoded token:', decoded);
The jsonwebtoken package is a popular library for working with JSON Web Tokens (JWTs). It provides functionalities for signing, verifying, and decoding tokens. Compared to idtoken-verifier, jsonwebtoken offers a broader range of features for handling JWTs, including token creation.
The jose package is a comprehensive library for JSON Web Algorithms (JWA), JSON Web Keys (JWK), JSON Web Signatures (JWS), and JSON Web Encryption (JWE). It provides extensive support for various cryptographic operations related to JWTs. While idtoken-verifier focuses on verifying ID tokens, jose offers a more extensive set of tools for working with JWTs and related standards.
The passport-jwt package is a Passport strategy for authenticating with JSON Web Tokens. It is used in conjunction with the Passport authentication middleware for Node.js. This package is more focused on integrating JWT authentication into web applications, whereas idtoken-verifier is specifically for verifying ID tokens.
A lightweight library to decode and verify RS JWT meant for the browser.
import IdTokenVerifier from 'idtoken-verifier';
const verifier = new IdTokenVerifier({
issuer: 'https://my.auth0.com/',
audience: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt'
});
verifier.verify(id_token, nonce, (error, payload) => {
...
});
var decoded = verifier.decode(id_token);
Initializes the verifier.
Parameters:
/.well-known/jwks.json
endpoint (or jwksURI
if provided) each time it verifies a token. You can provide a cache to store the keys and avoid repeated requests. For the contract, check this example. Hint: for in-memory cache, an easy way is to just provide new Map()
, which is a valid object for jwksCache.${id_token.iss}/.well-known/jwks.json
This method will decode the token, verify the issuer, audience, expiration, algorithm and nonce claims and after that will verify the token signature.
Parameters
This method will decode the token header and payload WITHOUT doing any verification.
Parameters
Return
To make it as lightweight as posible, it only provides support for RS256 tokens. It can be easily extensible to other RS* algorithms.
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
A lightweight library to decode and verify RS JWT meant for the browser.
The npm package idtoken-verifier receives a total of 168,315 weekly downloads. As such, idtoken-verifier popularity was classified as popular.
We found that idtoken-verifier demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.
Security News
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
Security News
The Socket Research team breaks down a malicious npm package targeting the legitimate DOMPurify library. It uses obfuscated code to hide that it is exfiltrating browser and crypto wallet data.