jose

What is jose?

The 'jose' npm package is a JavaScript library that provides a variety of cryptographic operations based on JSON Web Tokens (JWT), JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Key (JWK). It is designed to be compliant with the JOSE (JSON Object Signing and Encryption) suite of standards, and it supports various algorithms for encryption, decryption, signing, and verification of tokens.

What are jose's main functionalities?

JWT Signing

This code sample demonstrates how to create and sign a JWT with a specified algorithm and secret.

const { SignJWT } = require('jose');

const jwt = await new SignJWT({ 'urn:example:claim': true })
  .setProtectedHeader({ alg: 'HS256' })
  .setIssuedAt()
  .setIssuer('urn:example:issuer')
  .setAudience('urn:example:audience')
  .setExpirationTime('2h')
  .sign(new TextEncoder().encode('your-256-bit-secret'));

console.log(jwt);

JWT Verification

This code sample shows how to verify a JWT using a secret key and retrieve the payload and protected header.

const { jwtVerify } = require('jose');

const { payload, protectedHeader } = await jwtVerify(jwt, new TextEncoder().encode('your-256-bit-secret'));

console.log(payload);
console.log(protectedHeader);

JWE Encryption

This code sample illustrates how to encrypt a JWT using RSA-OAEP-256 for key management and A256GCM for content encryption.

const { EncryptJWT } = require('jose');

const jwe = await new EncryptJWT({ 'urn:example:claim': true })
  .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
  .setIssuedAt()
  .setIssuer('urn:example:issuer')
  .setAudience('urn:example:audience')
  .setExpirationTime('2h')
  .encrypt(publicKey);

console.log(jwe);

JWE Decryption

This code sample demonstrates how to decrypt a JWE and obtain the payload and protected header using a private key.

const { jwtDecrypt } = require('jose');

const { payload, protectedHeader } = await jwtDecrypt(jwe, privateKey);

console.log(payload);
console.log(protectedHeader);

JWK Key Generation

This code sample shows how to generate a public and private key pair for the RS256 algorithm.

const { generateKeyPair } = require('jose');

const { publicKey, privateKey } = await generateKeyPair('RS256');

console.log(publicKey);
console.log(privateKey);

Other packages similar to jose

jsonwebtoken

The 'jsonwebtoken' package is similar to 'jose' in that it provides functionality for creating and verifying JWTs. It is widely used and has a simpler API for basic JWT operations, but it does not support JWE or more advanced JOSE features.

node-jose

The 'node-jose' package is another alternative that implements the JOSE suite of standards. It offers similar functionalities to 'jose' but has a different API design and may have different performance characteristics.

jws

The 'jws' package is focused on JSON Web Signatures (JWS). It is a simpler library that allows signing and verifying messages but does not handle JWTs, JWEs, or JWKs directly.

README

The README file is missing