Class: RackJwtVerifier::JwtHelper Deprecated

Inherits:
Object
  • Object
show all
Defined in:
lib/rack_jwt_verifier/jwt_helper.rb

Overview

Deprecated.

Will be removed in 0.4.0. Issues (and, for round-trip checks, decodes) RS256 tokens from an RSA private key.

This is a second token issuer living inside the verifier: it sets neither iss, aud, nbf nor jti, so what it mints does not pass the claim policy the middleware now enforces. Issue tokens with the jwt_auth_client gem instead (HMAC today, RS256/ES256 from its 0.3.0); in a test suite, sign with JWT.encode directly — see spec/support/token_factory.rb in this repository for a helper you can copy.

Constant Summary collapse

ALGORITHM = 
'RS256'
DEPRECATION = 
'RackJwtVerifier::JwtHelper is deprecated and will be removed in 0.4.0: issue tokens with the ' \
'jwt_auth_client gem, or sign test tokens with JWT.encode. Set ' \
'RACK_JWT_VERIFIER_SILENCE_DEPRECATIONS=1 to silence this warning.'

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(private_key_pem) ⇒ JwtHelper

Returns a new instance of JwtHelper.

Parameters:

  • private_key_pem (String, OpenSSL::PKey::RSA) —

    The RSA private key used for signing.



48
49
50
51
52
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 48

def initialize(private_key_pem)
  self.class.warn_deprecated
  @private_key = private_key_pem.is_a?(OpenSSL::PKey::RSA) ? private_key_pem : OpenSSL::PKey::RSA.new(private_key_pem)
  @public_key = @private_key.public_key
end

Instance Attribute Details

#private_key ⇒ Object (readonly)

Returns the value of attribute private_key.



45
46
47
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 45

def private_key
  @private_key
end

#public_key ⇒ Object (readonly)

Returns the value of attribute public_key.



45
46
47
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 45

def public_key
  @public_key
end

Class Method Details

.reset_deprecation_warning! ⇒ Object

Forget that the warning was emitted. Intended for test suites.



40
41
42
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 40

def reset_deprecation_warning!
  @warn_lock.synchronize { @warned = false }
end

.warn_deprecated ⇒ Object

Emits the deprecation warning once per process.



28
29
30
31
32
33
34
35
36
37
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 28

def warn_deprecated
  return if ENV['RACK_JWT_VERIFIER_SILENCE_DEPRECATIONS'] == '1'

  @warn_lock.synchronize do
    return if @warned

    @warned = true
  end
  Kernel.warn(DEPRECATION, uplevel: 2)
end

Instance Method Details

#decode(token, options = {}) ⇒ Hash

Decodes and verifies a JWT with the public key. Meant for self-checks; the middleware's verification lives in Verifier.

Parameters:

  • token (String) —

    The JWT string to decode.

  • options (Hash) (defaults to: {}) —

    Extra options for JWT.decode (leeway, iss, verify_iss, ...).

Returns:

  • (Hash) —

    The decoded payload if verification is successful.

Raises:

  • (JWT::DecodeError) —

    If the token is invalid or expired.



74
75
76
77
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 74

def decode(token, options = {})
  payload, _header = JWT.decode(token, @public_key, true, { algorithm: ALGORITHM }.merge(options))
  payload
end

#encode(payload, expires_in = 3600) ⇒ String

Encodes a payload into a JWT, adding iat and exp.

Parameters:

  • payload (Hash) —

    Claims (string or symbol keys; an explicit exp in the payload wins).

  • expires_in (Integer) (defaults to: 3600) —

    Seconds until the token expires (default: 1 hour).

Returns:

  • (String) —

    The signed JWT string.



59
60
61
62
63
64
65
 
# File 'lib/rack_jwt_verifier/jwt_helper.rb', line 59

def encode(payload, expires_in = 3600)
  now = Time.now.to_i
  # Normalise to string keys first so a caller's 'exp' and our :exp cannot
  # both end up in the JSON as duplicate "exp" members.
  claims = { 'iat' => now, 'exp' => now + expires_in }.merge(payload.transform_keys(&:to_s))
  JWT.encode(claims, @private_key, ALGORITHM)
end