A simple JWT library using HMAC with optional NaCl encryption of claims meant to address critical vulnerabilities posted at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries

Algorithms: HS256, HS384 and HS512 only

Claims: set exp using the convenience function ExpiresInSeconds, ExpiresInMinutes or ExpiresInHours

Optional encryption of claims: call GenerateKey()

Generate a Token

func Sign(alg string, claims map[string]interface{}, secret, naclKey string) (string, error)

Rules:

alg can be HS256, HS384 or HS512 only (none is an error)
claims is a map or the equivalent of object in JavaScript
secret is used in HMAC signing
naclKey is used if you want to encrypt the claims (otherwise set it to "")
call GenerateKey() to generate naclKey

Verify a Token

func Verify(token, secret, naclKey string) (map[string]interface{}, error)

Returns the corresponding claims as map[string]interface{} if token is valid

Example

package main

import (
	"fmt"
	"github.com/ibmendoza/jwt"
	"time"
)

func main() {

	claims := make(map[string]interface{})
	claims["sub"] = "1234567890"
	claims["name"] = "John Doe"
	claims["admin"] = true
	claims["exp"] = jwt.ExpiresInSeconds(3)
	//claims["exp"] = jwt.ExpiresInMinutes(1)
	//claims["exp"] = jwt.ExpiresInHours(1)

	//fmt.Println(timeNow())

	naclKey, err := jwt.GenerateKey()
	fmt.Println(naclKey)

	token, err := jwt.Sign("HS384", claims, "secret", naclKey)
	if err != nil {
		fmt.Println(err)
	}

	fmt.Println(token, err) //encrypted claims

	token2, err := jwt.Sign("HS256", claims, "secret", "")
	if err != nil {
		fmt.Println(err)
	}

	fmt.Println(token2, err) //non-encrypted claims

	timer1 := time.NewTimer(time.Second * 2)
	<-timer1.C

	//fmt.Println(timeNow()) //after 2sec

	fmt.Println(jwt.Verify(token, "secret", naclKey)) //true
	fmt.Println(jwt.Verify(token, "scret", ""))       //false

	fmt.Println(jwt.Verify(token2, "secret", ""))     //true
	fmt.Println(jwt.Verify(token2, "scret", ""))      //false
	fmt.Println(jwt.Verify(token2, "secret", "asdf")) //false
	fmt.Println(jwt.Verify(token2, "secret", ""))     //false

	timer1 = time.NewTimer(time.Second * 2) //after 4secs
	<-timer1.C

	fmt.Println(jwt.Verify(token, "secret", naclKey)) //expired
}

Author

Isagani Mendoza (http://itjumpstart.wordpress.com)

License

MIT

Always-Encrypted Token? Try Salt

http://github.com/ibmendoza/salt

License

ibmendoza/jwt

ErrorLooks like something went wrong!

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages