http://hg.omfa.de/prosody-hg/ en-us prosody-hg: util/jwt.lua history util/jwt.lua revision history util: Prefix module imports with prosody namespace http://hg.omfa.de/prosody-hg/log/d10957394a3c/util/jwt.lua Kim Alvefur <zash@zash.se> Fri, 17 Mar 2023 16:23:16 +0100 util.jwt: More robust ECDSA signature parsing, fail early on unexpected length http://hg.omfa.de/prosody-hg/log/62100f31eb8a/util/jwt.lua Matthew Wild <mwild1@gmail.com> Fri, 30 Sep 2022 20:38:31 +0100 util.jwt: Add support for ES512 (+ tests) http://hg.omfa.de/prosody-hg/log/ad4ab01f9b11/util/jwt.lua Matthew Wild <mwild1@gmail.com> Thu, 29 Sep 2022 23:17:42 +0100 util.crypto, util.jwt: Generate consistent signature sizes (via padding) http://hg.omfa.de/prosody-hg/log/445f7bd6ffc4/util/jwt.lua
This fixes the signature parsing and building to work correctly. Sometimes
a signature was one or two bytes too short, and needed to be padded. OpenSSL
can do this for us.]]> Matthew Wild <mwild1@gmail.com> Thu, 29 Sep 2022 23:15:39 +0100 util.jwt: Add new init() convenience method to obtain both signer and verifier http://hg.omfa.de/prosody-hg/log/f75235110045/util/jwt.lua Matthew Wild <mwild1@gmail.com> Mon, 11 Jul 2022 13:43:01 +0100 util.jwt: Consolidate payload parsing, ensure it's always a valid object http://hg.omfa.de/prosody-hg/log/108b1758bd8d/util/jwt.lua Matthew Wild <mwild1@gmail.com> Mon, 11 Jul 2022 13:42:08 +0100 util.jwt: Provide built-in token expiry support (defaults to 3600s lifetime) http://hg.omfa.de/prosody-hg/log/008a7097fdc5/util/jwt.lua
To avoid every user of the library needing to add and verify expiry info, this
is now handled by util.jwt itself (if not overridden or disabled).

Issuing tokens that are valid forever is bad practice and rarely desired, and
the default token lifetime is now 3600s (1 hour).]]> Matthew Wild <mwild1@gmail.com> Mon, 11 Jul 2022 13:28:29 +0100 util.jwt: All the algorithms (+ all the tests!) http://hg.omfa.de/prosody-hg/log/31a2bd84191d/util/jwt.lua
Except 'none'. Not implementing that one.]]> Matthew Wild <mwild1@gmail.com> Sat, 02 Jul 2022 15:29:04 +0100 util.crypto: More digests for sign/verify, use macros for clarity/consistency http://hg.omfa.de/prosody-hg/log/f63176781940/util/jwt.lua Matthew Wild <mwild1@gmail.com> Sat, 02 Jul 2022 14:59:52 +0100 util.jwt: Add support for RSA-based algorithms (RS256, PS256) http://hg.omfa.de/prosody-hg/log/b3d0c1457584/util/jwt.lua Matthew Wild <mwild1@gmail.com> Sat, 02 Jul 2022 12:26:43 +0100 util.jwt: Add support/tests for ES256 via improved API and using util.crypto http://hg.omfa.de/prosody-hg/log/27a72982e331/util/jwt.lua
In many cases code will be either signing or verifying. With asymmetric
algorithms it's clearer and more efficient to just state that once, instead of
passing keys (and possibly other parameters) with every sign/verify call.

This also allows earlier validation of the key used.

The previous (HS256-only) sign/verify methods continue to be exposed for
backwards-compatibility.]]> Matthew Wild <mwild1@gmail.com> Fri, 01 Jul 2022 18:51:15 +0100 util.jwt: Use constant-time comparison with expected signature http://hg.omfa.de/prosody-hg/log/d2f33b8fdc96/util/jwt.lua Matthew Wild <mwild1@gmail.com> Thu, 13 May 2021 14:13:07 +0100 util.jwt: Basic JSON Web Token library supporting HS256 tokens http://hg.omfa.de/prosody-hg/log/c4ded3be7cc0/util/jwt.lua Kim Alvefur <zash@zash.se> Mon, 24 Feb 2020 01:24:25 +0100