Skip to content

Commit 5290db1

Browse files
committed
First assume JWT claim set is an object
draft-ietf-oauth-json-web-token does not require JWT objects to have typ: "JWT" in their header. Yet it expects that the JWT's claim set be JSON for validation. See step 10 of draft-ietf-oauth-json-web-token section 7.2 "Validating a JWT". Prior to this commit JWTs without typ: "JWT" in header are validated without ever checking the claim set.
1 parent db1cb1c commit 5290db1

File tree

2 files changed

+41
-2
lines changed

2 files changed

+41
-2
lines changed

index.js

+13-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,18 @@ var TokenExpiredError = module.exports.TokenExpiredError = require('./lib/TokenE
55

66
module.exports.decode = function (jwt, options) {
77
var decoded = jws.decode(jwt, options);
8-
return decoded && decoded.payload;
8+
var payload = decoded && decoded.payload;
9+
10+
if(typeof payload === 'string') {
11+
try {
12+
var obj = JSON.parse(payload);
13+
if(typeof obj === 'object') {
14+
return obj;
15+
}
16+
} catch (e) { }
17+
}
18+
19+
return payload;
920
};
1021

1122
module.exports.sign = function(payload, secretOrPrivateKey, options) {
@@ -109,7 +120,7 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback
109120
var payload;
110121

111122
try {
112-
payload = this.decode(jwtString);
123+
payload = this.decode(jwtString);
113124
} catch(err) {
114125
return done(err);
115126
}

test/verify.tests.js

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
var jwt = require('../index');
2+
var jws = require('jws');
3+
var fs = require('fs');
4+
var path = require('path');
5+
6+
var assert = require('chai').assert;
7+
8+
describe('verify', function() {
9+
var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'));
10+
var priv = fs.readFileSync(path.join(__dirname, 'priv.pem'));
11+
12+
it('should first assume JSON claim set', function () {
13+
var header = { alg: 'RS256' };
14+
var payload = { iat: Math.floor(Date.now() / 1000 ) };
15+
16+
var signed = jws.sign({
17+
header: header,
18+
payload: payload,
19+
secret: priv,
20+
encoding: 'utf8'
21+
});
22+
23+
jwt.verify(signed, pub, {typ: 'JWT'}, function(err, p) {
24+
assert.isNull(err);
25+
assert.deepEqual(p, payload);
26+
});
27+
});
28+
});

0 commit comments

Comments
 (0)