jwt-authentication - npm Package Compare versions

Comparing version 0.3.0 to 0.3.1

docs/CHANGELOG.md

@@ -0,1 +1,12 @@
+<a name"0.3.1"></a>
+### 0.3.1 (2017-05-02)
+
+
+#### Features
+
+* add integration tests ([d4c8a905](https://bitbucket.org/atlassianlabs/jwt-authentication/commits/d4c8a905ef1ae8488100db4d3f276bed718ed352))
+* throw error for malformed data uri ([705e1d52](https://bitbucket.org/atlassianlabs/jwt-authentication/commits/705e1d52d8831120d8d1f9378130a8e0dc1fd3ea))
+* convert privateKey data uris ([a422b991](https://bitbucket.org/atlassianlabs/jwt-authentication/commits/a422b9912ecf402f31e6dc421d69ec7851a29552))
+
+
 <a name"0.3.0"></a>
@@ -2,0 +13,0 @@ ## 0.3.0 (2016-10-10)

Gruntfile.js

@@ -149,2 +149,2 @@ var jwtAuthenticationMiddleware = require('./lib/server/http/jwt-auth-middleware');
     grunt.registerTask('watchIntegrationTest', ['grunt-contrib-watch:integration']);
-};
+};

index.d.ts

@@ -26,4 +26,5 @@ interface TokenGenerationOptions {
 interface ValidatorConfig {
-    publicKeyBaseUrl: string,
-    resourceServerAudience: string
+    publicKeyBaseUrl: string;
+    resourceServerAudience: string;
+    ignoreMaxLifeTime?: boolean;
 }
@@ -30,0 +31,0 @@

lib/client/jwt-generator.js

 var jsonWebToken = require('../jwt-authentication/json-web-token');
 var _ = require('lodash');
+var canonicalizePrivateKey = require('./canonicalize');
 
@@ -92,3 +93,3 @@ var getRequiredClaimsValidators = function() {
                 expiresInSeconds: options.expiresInSeconds,
-                privateKey: options.privateKey,
+                privateKey: canonicalizePrivateKey(options.kid, options.privateKey),
                 kid: options.kid,
@@ -95,0 +96,0 @@ iat: options.iat,

package.json

 {
   "name": "jwt-authentication",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Library that is used to create and verify json web tokens for service to service authentication purposes.",
@@ -51,4 +51,5 @@ "main": "index.js",
     "node-cache": "^3.0.0",
+    "node-forge": "^0.6.48",
     "q": "^1.1.2"
   }
 }

README.md

@@ -39,4 +39,14 @@ # JWT Authentication
 var generator = jwtAuthentication.client.create();
-var claims = {iss: 'name-of-client', sub: 'name-of-client', aud: 'name-of-server'};
-var options = {privateKey: privateKey, kid: 'name-of-client/key-id.pem'};
+
+var claims = {
+    iss: process.env.ASAP_ISSUER,
+    sub: 'name-of-client',
+    aud: 'name-of-server'
+};
+
+var options = {
+    privateKey: process.env.ASAP_PRIVATE_KEY,
+    kid: process.env.ASAP_KEY_ID
+};
+
 generator.generateAuthorizationHeader(claims, options, function (error, headerValue) {
@@ -56,8 +66,11 @@ if (error) {
 var jwtAuthentication = require('jwt-authentication');
+
 var authenticator = jwtAuthentication.server.create({
-        publicKeyServer: 'https://public-key-server.com',
-        resourceServerAudience: 'my-service',
-        ignoreMaxLifeTime: true // Setting this property will skip the 1 hour max lifetime checks and make your server less secure. Do not include this if you are not sure what you are doing.
-    });
+    publicKeyServer: process.env.ASAP_PUBLIC_KEY_REPOSITORY_URL,
+    resourceServerAudience: process.env.ASAP_AUDIENCE,
+    ignoreMaxLifeTime: false // Setting this property to true will skip the 1 hour max lifetime checks and make your server less secure. Do not include this if you are not sure what you are doing.
+});
+
 var authorizedSubjects = ['an-issuer'];
+
 authenticator.validate(token, authorizedSubjects, function (error, claims) {
@@ -64,0 +77,0 @@ if (error) {

test/integration/jwt-auth-middleware.spec.js

@@ -10,2 +10,3 @@ var fs = require('fs');
     var privateKey = fs.readFileSync('test/integration/key-server/an-issuer/private.pem');
+    var privateKeyDataUri = fs.readFileSync('test/integration/key-server/an-issuer/private-datauri');
     var incorrectPrivateKey = fs.readFileSync('test/integration/key-server/an-issuer/private-wrong.pem');
@@ -47,2 +48,17 @@
 
+    it('should authenticate valid token generated from dataUri', function (done) {
+        var claims = {iss: 'an-issuer', sub: 'an-issuer', aud: 'an-audience'};
+        var options = {kid: 'an-issuer/public.pem', privateKey: privateKeyDataUri};
+        invokeGenerateToken(claims, options, function (error, headerValue) {
+            requestWithAuthHeader(headerValue)
+                .then(function(responseAndBody) {
+                    var response = responseAndBody[0];
+                    var body = responseAndBody[1];
+                    expect(body).toBe('Ok');
+                    expect(response.statusCode).toBe(200);
+                    done();
+                }).fail(failTest(done));
+        });
+    });
+
     it('should authenticate valid token with audience array', function (done) {
@@ -49,0 +65,0 @@ var claims = {iss: 'an-issuer', sub: 'an-issuer', aud: ['an-audience', 'another-audience']};

test/integration/jwt-authentication.spec.js

@@ -12,2 +12,3 @@ var _ = require('lodash');
     var privateKey = fs.readFileSync('test/integration/key-server/an-issuer/private.pem');
+    var privateKeyDataUri = fs.readFileSync('test/integration/key-server/an-issuer/private-datauri');
     var incorrectPrivateKey = fs.readFileSync('test/integration/key-server/an-issuer/private-wrong.pem');
@@ -57,2 +58,18 @@
 
+        it('should create a correctly signed jwt token with data-uri private key', function (done) {
+            var claims = {iss: 'an-issuer', sub: 'a-subject', aud: 'an-audience', foo: 'abc', bar: 123};
+            var options = {kid: 'an-issuer/public.pem', privateKey: privateKeyDataUri};
+            generateToken(claims, options, function (error, token) {
+                expect(error).toBeNull('error');
+
+                var actualClaims = validateJwtToken(token, 'public');
+                expect(actualClaims.iss).toBe('an-issuer');
+                expect(actualClaims.sub).toBe('a-subject');
+                expect(actualClaims.aud).toBe('an-audience');
+                expect(actualClaims.foo).toBe('abc');
+                expect(actualClaims.bar).toBe(123);
+                done();
+            });
+        });
+
         it('should create a correctly signed jwt token with audience as an array', function (done) {
@@ -59,0 +76,0 @@ var claims = {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

141605

increased by6.07%

Number of package files

41

increased by10.81%

Lines of code

2466

increased by4.98%

Number of lines in readme file

152

increased by9.35%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dependency count

8

increased by14.29%

Dependency changes

• + Addednode-forge@^0.6.48

• + Addednode-forge@0.6.49(transitive)