Skip to content

Commit 39d9309

Browse files
committed
add support for validating multiples issuers. closes #163
1 parent 1959404 commit 39d9309

File tree

3 files changed

+15
-2
lines changed

3 files changed

+15
-2
lines changed

README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ encoded public key for RSA and ECDSA.
7878

7979
* `algorithms`: List of strings with the names of the allowed algorithms. For instance, `["HS256", "HS384"]`.
8080
* `audience`: if you want to check audience (`aud`), provide a value here
81-
* `issuer`: if you want to check issuer (`iss`), provide a value here
81+
* `issuer` (optional): string or array of strings of valid values for the `iss` field.
8282
* `ignoreExpiration`: if `true` do not validate the expiration of the token.
8383
* `ignoreNotBefore`...
8484
* `subject`: if you want to check subject (`sub`), provide a value here

index.js

+6-1
Original file line numberDiff line numberDiff line change
@@ -254,8 +254,13 @@ JWT.verify = function(jwtString, secretOrPublicKey, options, callback) {
254254
}
255255

256256
if (options.issuer) {
257-
if (payload.iss !== options.issuer)
257+
var invalid_issuer =
258+
(typeof options.issuer === 'string' && payload.iss !== options.issuer) ||
259+
(Array.isArray(options.issuer) && options.issuer.indexOf(payload.iss) === -1);
260+
261+
if (invalid_issuer) {
258262
return done(new JsonWebTokenError('jwt issuer invalid. expected: ' + options.issuer));
263+
}
259264
}
260265

261266
if (options.subject) {

test/jwt.rs.tests.js

+8
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,14 @@ describe('RS256', function() {
267267
});
268268
});
269269

270+
it('should check the issuer when providing a list of valid issuers', function(done) {
271+
jwt.verify(token, pub, { issuer: [ 'urn:foo', 'urn:bar' ] }, function(err, decoded) {
272+
assert.isNotNull(decoded);
273+
assert.isNull(err);
274+
done();
275+
});
276+
});
277+
270278
it('should throw when invalid issuer', function(done) {
271279
jwt.verify(token, pub, { issuer: 'urn:wrong' }, function(err, decoded) {
272280
assert.isUndefined(decoded);

0 commit comments

Comments
 (0)