anvilresearch / connect-jwt Goto Github PK

We should consider using native cryptography in all conditional cases, wherever possible, so that we don't have to bring in jsrsasign.

For a decentralized cross-domain auth use case, when a relying party is registered with multiple issuers/providers, it's necessary to be able to decode an OIDC token without verification (decode to discover the issuer, which lets one instantiate a client, which then lets one verify the token later on).
So: add an option to decode() to skip verification.

jsrsasign removed jsjws.verifyJWSByNE, which we use, in a minor release, violating semver.

This is causing failing tests and breaking functionality in connect-nodejs.

Either we wait for @kjur to release a fixed copy and pin the version of the jsrsasign dependency to an older version for now, or we find an alternative and replace jsrsasign now.

Either way, since these functions are deprecated, it sounds like we'll have to replace them eventually.

Some claims in OpenID Connect, such as aud, can be a string or an array of strings. We need an additional format/validation function for these cases.