mirror of
https://github.com/musix-org/musix-oss
synced 2024-12-23 13:03:18 +00:00
182 lines
5.3 KiB
JavaScript
182 lines
5.3 KiB
JavaScript
var JsonWebTokenError = require('./lib/JsonWebTokenError');
|
|
var NotBeforeError = require('./lib/NotBeforeError');
|
|
var TokenExpiredError = require('./lib/TokenExpiredError');
|
|
var decode = require('./decode');
|
|
var timespan = require('./lib/timespan');
|
|
var jws = require('jws');
|
|
var xtend = require('xtend');
|
|
|
|
module.exports = function (jwtString, secretOrPublicKey, options, callback) {
|
|
if ((typeof options === 'function') && !callback) {
|
|
callback = options;
|
|
options = {};
|
|
}
|
|
|
|
if (!options) {
|
|
options = {};
|
|
}
|
|
|
|
//clone this object since we are going to mutate it.
|
|
options = xtend(options);
|
|
var done;
|
|
|
|
if (callback) {
|
|
done = callback;
|
|
} else {
|
|
done = function(err, data) {
|
|
if (err) throw err;
|
|
return data;
|
|
};
|
|
}
|
|
|
|
if (options.clockTimestamp && typeof options.clockTimestamp !== 'number') {
|
|
return done(new JsonWebTokenError('clockTimestamp must be a number'));
|
|
}
|
|
|
|
var clockTimestamp = options.clockTimestamp || Math.floor(Date.now() / 1000);
|
|
|
|
if (!jwtString){
|
|
return done(new JsonWebTokenError('jwt must be provided'));
|
|
}
|
|
|
|
if (typeof jwtString !== 'string') {
|
|
return done(new JsonWebTokenError('jwt must be a string'));
|
|
}
|
|
|
|
var parts = jwtString.split('.');
|
|
|
|
if (parts.length !== 3){
|
|
return done(new JsonWebTokenError('jwt malformed'));
|
|
}
|
|
|
|
var hasSignature = parts[2].trim() !== '';
|
|
|
|
if (!hasSignature && secretOrPublicKey){
|
|
return done(new JsonWebTokenError('jwt signature is required'));
|
|
}
|
|
|
|
if (hasSignature && !secretOrPublicKey) {
|
|
return done(new JsonWebTokenError('secret or public key must be provided'));
|
|
}
|
|
|
|
if (!hasSignature && !options.algorithms) {
|
|
options.algorithms = ['none'];
|
|
}
|
|
|
|
if (!options.algorithms) {
|
|
options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') ||
|
|
~secretOrPublicKey.toString().indexOf('BEGIN PUBLIC KEY') ?
|
|
[ 'RS256','RS384','RS512','ES256','ES384','ES512' ] :
|
|
~secretOrPublicKey.toString().indexOf('BEGIN RSA PUBLIC KEY') ?
|
|
[ 'RS256','RS384','RS512' ] :
|
|
[ 'HS256','HS384','HS512' ];
|
|
|
|
}
|
|
|
|
var decodedToken;
|
|
try {
|
|
decodedToken = jws.decode(jwtString);
|
|
} catch(err) {
|
|
return done(err);
|
|
}
|
|
|
|
if (!decodedToken) {
|
|
return done(new JsonWebTokenError('invalid token'));
|
|
}
|
|
|
|
var header = decodedToken.header;
|
|
|
|
if (!~options.algorithms.indexOf(header.alg)) {
|
|
return done(new JsonWebTokenError('invalid algorithm'));
|
|
}
|
|
|
|
var valid;
|
|
|
|
try {
|
|
valid = jws.verify(jwtString, header.alg, secretOrPublicKey);
|
|
} catch (e) {
|
|
return done(e);
|
|
}
|
|
|
|
if (!valid)
|
|
return done(new JsonWebTokenError('invalid signature'));
|
|
|
|
var payload;
|
|
|
|
try {
|
|
payload = decode(jwtString);
|
|
} catch(err) {
|
|
return done(err);
|
|
}
|
|
|
|
if (typeof payload.nbf !== 'undefined' && !options.ignoreNotBefore) {
|
|
if (typeof payload.nbf !== 'number') {
|
|
return done(new JsonWebTokenError('invalid nbf value'));
|
|
}
|
|
if (payload.nbf > clockTimestamp + (options.clockTolerance || 0)) {
|
|
return done(new NotBeforeError('jwt not active', new Date(payload.nbf * 1000)));
|
|
}
|
|
}
|
|
|
|
if (typeof payload.exp !== 'undefined' && !options.ignoreExpiration) {
|
|
if (typeof payload.exp !== 'number') {
|
|
return done(new JsonWebTokenError('invalid exp value'));
|
|
}
|
|
if (clockTimestamp >= payload.exp + (options.clockTolerance || 0)) {
|
|
return done(new TokenExpiredError('jwt expired', new Date(payload.exp * 1000)));
|
|
}
|
|
}
|
|
|
|
if (options.audience) {
|
|
var audiences = Array.isArray(options.audience)? options.audience : [options.audience];
|
|
var target = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
|
|
|
|
var match = target.some(function(targetAudience) {
|
|
return audiences.some(function(audience) {
|
|
return audience instanceof RegExp ? audience.test(targetAudience) : audience === targetAudience;
|
|
});
|
|
});
|
|
|
|
if (!match)
|
|
return done(new JsonWebTokenError('jwt audience invalid. expected: ' + audiences.join(' or ')));
|
|
}
|
|
|
|
if (options.issuer) {
|
|
var invalid_issuer =
|
|
(typeof options.issuer === 'string' && payload.iss !== options.issuer) ||
|
|
(Array.isArray(options.issuer) && options.issuer.indexOf(payload.iss) === -1);
|
|
|
|
if (invalid_issuer) {
|
|
return done(new JsonWebTokenError('jwt issuer invalid. expected: ' + options.issuer));
|
|
}
|
|
}
|
|
|
|
if (options.subject) {
|
|
if (payload.sub !== options.subject) {
|
|
return done(new JsonWebTokenError('jwt subject invalid. expected: ' + options.subject));
|
|
}
|
|
}
|
|
|
|
if (options.jwtid) {
|
|
if (payload.jti !== options.jwtid) {
|
|
return done(new JsonWebTokenError('jwt jwtid invalid. expected: ' + options.jwtid));
|
|
}
|
|
}
|
|
|
|
if (options.maxAge) {
|
|
if (typeof payload.iat !== 'number') {
|
|
return done(new JsonWebTokenError('iat required when maxAge is specified'));
|
|
}
|
|
|
|
var maxAgeTimestamp = timespan(options.maxAge, payload.iat);
|
|
if (typeof maxAgeTimestamp === 'undefined') {
|
|
return done(new JsonWebTokenError('"maxAge" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));
|
|
}
|
|
if (clockTimestamp >= maxAgeTimestamp + (options.clockTolerance || 0)) {
|
|
return done(new TokenExpiredError('maxAge exceeded', new Date(maxAgeTimestamp * 1000)));
|
|
}
|
|
}
|
|
|
|
return done(null, payload);
|
|
};
|