Security News
Weekly Downloads Now Available in npm Package Search Results
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
jwks-utils
Advanced tools
Utility methods for working with a JSON Web Key (JWK) and/or JSON Web Key Set (JWKs)
A set of useful tools when working with JSON Web Key (JWK) and JSON Web Key Set (JWKs).
$ npm install jwks-utils
var jwksUtils = require('jwks-utils');
var jwk = { kid: '1234', kty: 'RSA', n: '12345...XYZ=', e: 'AQAB' };
var jwks = { keys: [ jwk ] }
// Detect a JWK object
if(jwksUtils.isJWK(jwk)) {
// Do stuff with the JWk
}
// Detect a JWKs object
if(jwksUtils.isJWKset(jwks)) {
// Do stuff with the JWKs
}
// Find a particilar JWK within a JWKs
var jwk1 = jwkUtils.findJWK('1234', jwks);
// Find the JWK corsponding to a particular JWS (or JWT)
var signature = getJWSFromSomwhere();
jwkUtils.jwkForSignature(signature, false, {timeout: 100}, function(err, jwk2) {
if (!err) {
// jwk2 is the corresponding JWK
}
};
jwks
) from a JSON Web Key URI (jku
)This library makes requests to outside web URI's if it determines that a jku
is needed
to get the public key (jwk
) to verify a signature. It expects that URL to have a JSON
Web Key Set (jwks
according to the standard). Because this process can sometimes be
slow, and because in production sometimes networks go down, we have added a small in-memory
cache to this library.
When the library decides it needs a jwks
from a jku
, it will immediately return the
cached value if the given signature's key is in the cached keyset. It will also fire off
a request in the background that will update the cache to the latest copy of the jwk set.
It will consider the cache entry stale after 1 hour and then wait for the request to update
the cache.
If the key in the signature was not in a cached jwks
(or it was not yet cached at all),
the function will wait for the request to finish. Once it finishes, if there was an error
in the request, it will check the cache to see if we have a stale cached copy. If so, then
it will use that stale cached copy for up to 24 hours before removing it from the cache.
If it does not have an error in the request, even if we've already returned the cached copy
for the signature, it will go ahead and put the new response's jwks
into the cache and then
return it.
In this way, whenever you publish a new kid
in your jwks
, any clients will immediately be
able to use it. However, if you revoke a kid
, the client will still allow for 1 valid
signature in the first hour, and then any request after the first one, or after an hour, will
be invalid.
FAQs
Utility methods for working with a JSON Web Key (JWK) and/or JSON Web Key Set (JWKs)
The npm package jwks-utils receives a total of 143 weekly downloads. As such, jwks-utils popularity was classified as not popular.
We found that jwks-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
Security News
A Stanford study reveals 9.5% of engineers contribute almost nothing, costing tech $90B annually, with remote work fueling the rise of "ghost engineers."
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.