Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

jwks-utils

Package Overview
Dependencies
Maintainers
2
Versions
10
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

jwks-utils

Utility methods for working with a JSON Web Key (JWK) and/or JSON Web Key Set (JWKs)

  • 1.0.10
  • latest
  • Source
  • npm
  • Socket score

Version published
Maintainers
2
Created
Source

Build Status Coverage Status Dependency Status License

node-jwks-utils

A set of useful tools when working with JSON Web Key (JWK) and JSON Web Key Set (JWKs).

Install

$ npm install jwks-utils

Example

var jwksUtils = require('jwks-utils');

var jwk = { kid: '1234', kty: 'RSA', n: '12345...XYZ=', e: 'AQAB' };
var jwks = { keys: [ jwk ] }

// Detect a JWK object
if(jwksUtils.isJWK(jwk)) {
    // Do stuff with the JWk
}

// Detect a JWKs object
if(jwksUtils.isJWKset(jwks)) {
    // Do stuff with the JWKs
}

// Find a particilar JWK within a JWKs
var jwk1 = jwkUtils.findJWK('1234', jwks);

// Find the JWK corsponding to a particular JWS (or JWT)
var signature = getJWSFromSomwhere();
jwkUtils.jwkForSignature(signature, false, {timeout: 100}, function(err, jwk2) {
    if (!err) {
        // jwk2 is the corresponding JWK
    }
};

Caching of JSON Web Key Sets (jwks) from a JSON Web Key URI (jku)

This library makes requests to outside web URI's if it determines that a jku is needed to get the public key (jwk) to verify a signature. It expects that URL to have a JSON Web Key Set (jwks according to the standard). Because this process can sometimes be slow, and because in production sometimes networks go down, we have added a small in-memory cache to this library.

When the library decides it needs a jwks from a jku, it will immediately return the cached value if the given signature's key is in the cached keyset. It will also fire off a request in the background that will update the cache to the latest copy of the jwk set. It will consider the cache entry stale after 1 hour and then wait for the request to update the cache.

If the key in the signature was not in a cached jwks (or it was not yet cached at all), the function will wait for the request to finish. Once it finishes, if there was an error in the request, it will check the cache to see if we have a stale cached copy. If so, then it will use that stale cached copy for up to 24 hours before removing it from the cache.

If it does not have an error in the request, even if we've already returned the cached copy for the signature, it will go ahead and put the new response's jwks into the cache and then return it.

In this way, whenever you publish a new kid in your jwks, any clients will immediately be able to use it. However, if you revoke a kid, the client will still allow for 1 valid signature in the first hour, and then any request after the first one, or after an hour, will be invalid.

References

  1. JSON Web Key (JWK) Draft 40

Keywords

FAQs

Package last updated on 10 Jul 2019

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc