Comments (4)
I'd like to add two remarks, if you don't mind:
-
The current behavior is not uncommon, for example the auth0/java-jwt library requires the developer to make a second instance of their JWT class, using the public key. I'm not implying that this experience cannot or should not be improved.
-
Fun fact: an RSA private key implicitly contains the public key too. If you combine this with the way how RSA validation is implemented in LibreSSL (hint: both keys are decoded into the same
RSA
C struct), it's almost trivially simple to both sign and verify tokens with the private key only. The only thing that needs to be changed is the call tod2i_RSA_PUBKEY
in RSASigner.swift.
(I confirmed it by replacing this call withd2i_RSAPrivateKey
as above.)
So an ideal implementation of RSASigner IMHO would detect if the provided key is a private or public key. If it's a private key, both functions can work directly using it. If it's a public key, sign
should throw an error and verify
should work as expected.
from jwt.
Ah, being able to use d2i_RSAPrivateKey
in the verify function is the piece I was missing. Awesome.
If it's that easy to use the private key for verification then we should definitely avoid asking the user to input both keys. That's another user input step which I'm happy to avoid.
I'm thinking the best solution here is to have the RSA signers take a Key enum:
enum Key {
case public(value: Bytes)
case private(value: Bytes)
}
In an attempt to create a JWT with a Key.public
we can throw an error along the lines of JWTError.privateKeyRequired
By not requiring the private key we can allow this package to be used in client code.
The Config/jwt.json
in the jwt-provider package could then look something like
{
"signer": {
"type": "rsa",
"algorithm": "rs256",
"key": {
"type": "public",
"value": "..."
}
}
}
from jwt.
I think introducing a public enum or otherwise changing the current public interface is not necessary.
The RSASigner could try to parse the raw bytes in both formats and see which function returns success, throwing an error only in sign mode with a public key, or if neither decoding worked.
Everything else should Just Work transparently.
(Also, if RSASigner was a class instead of a protocol, it would be possible to decode the key only once in the initializer instead of in each request. It's an immutable bag of big integers, and as DER-encoded bytes are held in memory anyway, keeping the RSA in too is not less secure.)
from jwt.
+1 to the idea of parsing the key once and holding onto that.
However, I like the clarity around providing either a public or private key at the configuration level. If someone reading the code sees Key.private
it's clear this is something sensitive.
I do like the idea of "just working", though.
I'll throw together a PR for this and see if there are any underwater rocks with either option that might make the other more attractive.
from jwt.
Related Issues (20)
- ES256 implementation is incorrect HOT 1
- Sporadic failure of ES256 HOT 2
- Error when creating a public signer for certificates HOT 5
- Allow JWT to be extended by user HOT 3
- Documentation request. HOT 2
- Allow configuration of URIs in JWT helpers HOT 6
- Multiple JWT signers not working as expected HOT 1
- Could not create public key from x509Cert HOT 22
- This framework doesn't consider someone may use it in macOS? HOT 8
- Support for Swift 2.1 HOT 1
- Carthage support HOT 2
- Is this library can be installed using pods? HOT 4
- Missing RSA Encryption Algorithms HOT 3
- JWK Verification HOT 2
- integrate JWTKit with Vapor HOT 9
- Broken link to documentation HOT 1
- Library not working with Swift 3 HOT 1
- Missing ECDSASigner to support ES256 … HOT 4
- '&' used with non-inout argument of type 'JWT<_>' HOT 1
- [Question] - Encode with RS256 using string data of a private key HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jwt.