Comments (4)
@jfromaniello what would you recommend as a node lib which would asymmetrically encrypt JWTs from node-jsonwebtoken ?
from node-jsonwebtoken.
Is it useful adding possibility of encrypting payload using AES to the api?
I implemented such feature for my project and I think it can be useful in cases when payload data should be kept hidden from the client side.
I don't know whether I should release it on a different module or it can be merge to this project via pull request.
from node-jsonwebtoken.
The standard JWT describe two things signing (JWS: JSON Web Signature) and encryption (JWE: json web encription).
With JWE you don't encrypt the payload but the signed JWT.
There are some implementations of JWE for node.js and I will definitely consider a pull request including support for JWE tokens.
from node-jsonwebtoken.
@jfromaniello Hey, I have integrated JWE encryption within node-jsonwebtoken based on works of node-webtokens.
I have implemented modifications in sign.js which takes extra options key 'encrypt' to opt JWE automatically and verify.js is [WIP].
jwt.sign({ foo: 'bar' }, cert, { algorithm: 'RSA-OAEP', encrypt: 'A256GCM' },function (err, signedToken) { console.log(signedToken); })
JWE uses crypto.js for content and key encryption which is included in lib, please check supported key management algorithms and content encryption algorithms here.
Do let me know if it looks good and I will raise a pull request for same.
Note, Work In Progress: jwt.verify()
from node-jsonwebtoken.
Related Issues (20)
- Set options via Environment Variables
- Rename `decode` function `unsafeDecode` to highlight the risk HOT 6
- Importing `decode` function from jsonwebtoken causes error HOT 4
- Verify an already decoded token HOT 2
- JWT payload size > 475 bytes
- Signature generation fails for SM2 private keys with ES256 algorithm for node 18 version HOT 1
- What if any user stole my accessToken and paste it to his browser cookie storage (using browser delveoper tool) ? HOT 1
- Disallowing Validation of Expired Tokens
- GCP KMS to Create JWT
- Use along KMS asymmetrical key
- Error using jsonwebtoken: global is not defined HOT 2
- import `jsonwebtoken` throws error HOT 4
- Documentation Duplicacy
- What happened? The performance of jsonwebtoken 9.0.2 is 50 times slower than 8.5.1 HOT 1
- HS256 algorithm JWT sign returning RS256 Algorithm instead of HS256
- allowInsecureKeySizes flag not present among TS types.
- Next js - Getting Error while trying to verifying the token with secret in v9+ error is right-hand side of 'instanceof' is not an object
- Next js - Getting Error while trying to verifying the token with secret in v9+ error is right-hand side of 'instanceof' is not an object #973 HOT 1
- JWT Token Not Stored in Safari Browser (iOS and macOS) Due to Cross-Site Tracking Prevention HOT 1
- JWT returns "invalid token" when trying to use "Bearer" prefix at token HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from node-jsonwebtoken.