search

auth0 / node-jwa

JSON Web Algorithms
http://tools.ietf.org/id/draft-ietf-jose-json-web-algorithms-08.html
MIT License
98 stars 42 forks source link

module ignores b64 in the header #36

Open namrata25 opened 5 years ago

namrata25 commented 5 years ago

Hello,

I am using jws library which internally uses this module and it seems that the signature generated does not meet the specifications.

According to the standards, if I pass b64: false in the header, the signature returned should not be base64Url encoded.

After going through the code of the library, it looks like you are returning base64Url encoded signature irrespective of what is passed in the header.

https://github.com/brianloveswords/node-jwa/blob/master/index.js#L153

Would appreciate your take on this.

Thanks

panva commented 5 years ago

Hi @namrata25

1) RFC7797 talks about unencoded payload, not signatures. 2) "b64": false MUST be accompanied by "crit": ["b64"] in the header. 1, 2 3) Implementations MUST throw when "crit" members aren't understood by the implementation.

Since this jwa module really only deals with signing and verification of provided inputs what you're asking should be part of the module you're using.

Other JOSE packages, e.g. jose support the RFC7797-defined b64 critical parameter.