-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Comparing changes
Open a pull request
base repository: auth0/node-jsonwebtoken
base: v8.5.1
head repository: auth0/node-jsonwebtoken
compare: v9.0.0
- 17 commits
- 39 files changed
- 15 contributors
Commits on Apr 12, 2019
-
Configuration menu - View commit details
-
Copy full SHA for a9e38b8 - Browse repository at this point
Copy the full SHA a9e38b8View commit details
Commits on Oct 21, 2019
-
Configuration menu - View commit details
-
Copy full SHA for 9fb90ca - Browse repository at this point
Copy the full SHA 9fb90caView commit details -
Configuration menu - View commit details
-
Copy full SHA for 5ed1f06 - Browse repository at this point
Copy the full SHA 5ed1f06View commit details
Commits on Nov 29, 2019
-
Adds not to README on decoded payload validation (#646)
Adds a note to the README that suggest that decoded payload should not be trusted and should be treated as user inputs.
Configuration menu - View commit details
-
Copy full SHA for a6235fa - Browse repository at this point
Copy the full SHA a6235faView commit details
Commits on Feb 10, 2020
-
Replace tilde-indexOf with includes (#647)
* Replace tilde-indexOf with includes * remove package lock
Configuration menu - View commit details
-
Copy full SHA for 88cb9df - Browse repository at this point
Copy the full SHA 88cb9dfView commit details
Commits on Mar 24, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 5f10bf9 - Browse repository at this point
Copy the full SHA 5f10bf9View commit details
Commits on Sep 10, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 15a1bc4 - Browse repository at this point
Copy the full SHA 15a1bc4View commit details -
Configuration menu - View commit details
-
Copy full SHA for a46097e - Browse repository at this point
Copy the full SHA a46097eView commit details
Commits on Nov 9, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 3765003 - Browse repository at this point
Copy the full SHA 3765003View commit details
Commits on Feb 18, 2021
-
Configuration menu - View commit details
-
Copy full SHA for d71e383 - Browse repository at this point
Copy the full SHA d71e383View commit details
Commits on Mar 31, 2021
-
Configuration menu - View commit details
-
Copy full SHA for 74d5719 - Browse repository at this point
Copy the full SHA 74d5719View commit details
Commits on Oct 26, 2022
-
Co-authored-by: sre-57-opslevel[bot] <113727212+sre-57-opslevel[bot]@users.noreply.github.com>
Configuration menu - View commit details
-
Copy full SHA for 7e6a86b - Browse repository at this point
Copy the full SHA 7e6a86bView commit details
Commits on Nov 29, 2022
-
fix(sign&verify)!: Remove default
none
support fromsign
and `ver……ify` methods, and require it to be explicitly configured (#851) * fix(sign&verify)!: Remove default none support from sign and verify methods, and require it to be explicitly configured BREAKING CHANGE: Removes fallback for none algorithm for the verify method.
Configuration menu - View commit details
-
Copy full SHA for 8345030 - Browse repository at this point
Copy the full SHA 8345030View commit details -
fix!: Prevent accidental use of insecure key sizes & misconfiguration…
… of secrets (#852) * fix!: Disable use of weak RSA key sizes for asymmetric algorithms Added checks to prevent invalid secrets from being used with the HS*** algorithms when signing and verifying Added checks to prevent the use of insecure asymmetric key sizes except when explicitly overriden via options Prevented Buffers containing malicious objects from being used as key material. BREAKING CHANGE: Requires node 12.x or later to allow use of `KeyObject`
Configuration menu - View commit details
-
Copy full SHA for ecdf6cc - Browse repository at this point
Copy the full SHA ecdf6ccView commit details
Commits on Dec 2, 2022
-
chore(ci): configure Github Actions jobs for Tests & Security Scanning (
#856) * chore: add github actions test job * chore: configure semgrep ci job
Configuration menu - View commit details
-
Copy full SHA for cd4163e - Browse repository at this point
Copy the full SHA cd4163eView commit details
Commits on Dec 12, 2022
-
Configuration menu - View commit details
-
Copy full SHA for 5eaedbf - Browse repository at this point
Copy the full SHA 5eaedbfView commit details
Commits on Dec 21, 2022
-
Merge pull request from GHSA-8cf7-32gw-wr33
* Check if node version supports asymmetricKeyDetails * Validate algorithms for ec key type * Rename variable * Rename function * Add early return for symmetric keys * Validate algorithm for RSA key type * Validate algorithm for RSA-PSS key type * Check key types for EdDSA algorithm * Rename function * Move validateKey function to module * Convert arrow to function notation * Validate key in verify function * Simplify if * Convert if to switch..case * Guard against empty key in validation * Remove empty line * Add lib to check modulus length * Add modulus length checks * Validate mgf1HashAlgorithm and saltLength * Check node version before using key details API * Use built-in modulus length getter * Fix Node version validations * Remove duplicate validateKey * Add periods to error messages * Fix validation in verify function * Make asymmetric key validation the latest validation step * Change key curve validation * Remove support for ES256K * Fix old test that was using wrong key types to sign tokens * Enable RSA-PSS for old Node versions * Add specific RSA-PSS validations on Node 16 LTS+ * Improve error message * Simplify key validation code * Fix typo * Improve error message * Change var to const in test * Change const to let to avoid reassigning problem * Improve error message * Test incorrect private key type * Rename invalid to unsupported * Test verifying of jwt token with unsupported key * Test invalid private key type * Change order of object parameters * Move validation test to separate file * Move all validation tests to separate file * Add prime256v1 ec key * Remove modulus length check * WIP: Add EC key validation tests * Fix node version checks * Fix error message check on test * Add successful tests for EC curve check * Remove only from describe * Remove `only` * Remove duplicate block of code * Move variable to a different scope and make it const * Convert allowed curves to object for faster lookup * Rename variable * Change variable assignment order * Remove unused object properties * Test RSA-PSS happy path and wrong length * Add missing tests * Pass validation if no algorithm has been provided * Test validation of invalid salt length * Test error when signing token with invalid key * Change var to const/let in verify tests * Test verifying token with invalid key * Improve test error messages * Add parameter to skip private key validation * Replace DSA key with a 4096 bit long key * Test allowInvalidPrivateKeys in key signing * Improve test message * Rename variable * Add key validation flag tests * Fix variable name in Readme * Change private to public dsa key in verify * Rename flag * Run EC validation tests conditionally * Fix tests in old node versions * Ignore block of code from test coverage * Separate EC validations tests into two different ones * Add comment * Wrap switch in if instead of having an early return * Remove unsupported algorithms from asymmetric key validation * Rename option to allowInvalidAsymmetricKeyTypes and improve Readme * 9.0.0 * adding migration notes to readme * adding changelog for version 9.0.0 Co-authored-by: julienwoll <[email protected]>
11Configuration menu - View commit details
-
Copy full SHA for e1fa9dc - Browse repository at this point
Copy the full SHA e1fa9dcView commit details
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v8.5.1...v9.0.0