auth0 / node-jws

JSON Web Signatures
http://self-issued.info/docs/draft-ietf-jose-json-web-signature.html
MIT License
709 stars 108 forks source link

Error: The first argument must be one of type... #74

Closed rightaway closed 5 years ago

rightaway commented 6 years ago

If you pass a random string like 'test' to jws.verify, you get this error. Instead it should just return false.

  TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be one of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type undefined
      at Function.from (buffer.js:199:11)
      at Object.verify (....../node_modules/jwa/index.js:43:31)
      at Object.jwsVerify [as verify] (....../node_modules/jws/lib/verify-stream.js:54:15)
rightaway commented 6 years ago

What do you think about this feature request? Because currently the code is messy

let verified
try {
  verified = jws.verify(signature, algorithm, secretOrKey)
} catch (e) {
  if (e.name === 'TypeError [ERR_INVALID_ARG_TYPE]') {
    log(e)
  } else {
    throw e  // something unexpected
  }
}
if (!verified) {
  log(e)
} else {
  // verified
}

If the feature request is approved then the code can just become

if (!jws.verify(signature, algorithm, secretOrKey)) {
  log(e)
} else {
  // verified
}
rightaway commented 5 years ago

Is there any agreement on this issue or there's no interest in such a change by the maintainers?

omsmith commented 5 years ago

While the specific error raised could likely be improved - I do believe passing something you expected to be a JWS that turned out not to be is quite exceptional, and hiding that information is not desirable in the general sense.

There are other reasons the verify call will throw as well, so I don't think your code will end up changing in any significant sense.

Appreciate the feedback nonetheless.

Thanks

rightaway commented 5 years ago

What are the other reasons that will cause verify to throw?