corrected algorithm object in crypto.verify for ecdsa

delivery/common/cwt/examples/cwt-es256/cwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.1.0 */
+/** @preserve @version 1.1.1 */
 import { crypto } from "crypto";
 
 import { Encoder, Decoder } from "./cbor-x.js";
@@ -45,9 +45,7 @@ class Sign {
             let isSignVerified = !1;
             for (const key of keys) if (isSignVerified = await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, key, signature, new Uint8Array(message)), isSignVerified) return Promise.resolve(isSignVerified);
             return Promise.resolve(isSignVerified);
         }

delivery/common/cwt/examples/cwt-hs256/cwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.1.0 */
+/** @preserve @version 1.1.1 */
 import { crypto } from "crypto";
 
 import { Encoder, Decoder } from "./cbor-x.js";
@@ -45,9 +45,7 @@ class Sign {
             let isSignVerified = !1;
             for (const key of keys) if (isSignVerified = await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, key, signature, new Uint8Array(message)), isSignVerified) return Promise.resolve(isSignVerified);
             return Promise.resolve(isSignVerified);
         }

delivery/common/cwt/examples/typescript/src/cwt/cwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.1.0 */
+/** @preserve @version 1.1.1 */
 import { crypto } from "crypto";
 
 import { Encoder, Decoder } from "./cbor-x.js";
@@ -45,9 +45,7 @@ class Sign {
             let isSignVerified = !1;
             for (const key of keys) if (isSignVerified = await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, key, signature, new Uint8Array(message)), isSignVerified) return Promise.resolve(isSignVerified);
             return Promise.resolve(isSignVerified);
         }

delivery/common/cwt/lib/cwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.1.0 */
+/** @preserve @version 1.1.1 */
 import { crypto } from "crypto";
 
 import { Encoder, Decoder } from "./cbor-x.js";
@@ -45,9 +45,7 @@ class Sign {
             let isSignVerified = !1;
             for (const key of keys) if (isSignVerified = await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, key, signature, new Uint8Array(message)), isSignVerified) return Promise.resolve(isSignVerified);
             return Promise.resolve(isSignVerified);
         }

delivery/common/jwt/examples/jwt-es256/README.md

@@ -0,0 +1,2 @@
+# Example
+This example demonstrates verification of a JWT token that was signed using the RS256 algorithm.

delivery/common/jwt/examples/jwt-es256/bundle.json

@@ -0,0 +1,4 @@
+{
+  "edgeworker-version": "0.1",
+  "description" : "JWT validator example with ES256"
+}

delivery/common/jwt/examples/jwt-es256/jwt.js

@@ -0,0 +1,127 @@
+/** @preserve @version 1.0.1 */
+import { crypto } from "crypto";
+
+import { base64url, TextEncoder } from "encoding";
+
+class JWTUtil {
+    static isEmptyString(str) {
+        return !str || 0 === str.trim().length;
+    }
+}
+
+class JWTValidator {
+    constructor(jwtOptions) {
+        this.jwtOptions = jwtOptions || {}, this.validateOptionTypes(), this.algorithms = [ "RS256", "RS384", "RS512", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" ], 
+        this.jwtOptions.allowUnsecuredToken && this.algorithms.push("NONE");
+    }
+    async validate(base64JWTToken, keys) {
+        var _a, _b;
+        if ("string" != typeof base64JWTToken) throw new Error("Invalid token type, expected string!");
+        if (!Array.isArray(keys) || !keys.every((elem => void 0 !== elem.type || void 0 !== elem.extractable || null != elem.algorithm || null != elem.usages))) throw new Error("Invalid keys type, expected list of CryptoKey!");
+        const jwtParts = base64JWTToken.split(".");
+        if (jwtParts.length > 3 || jwtParts.length < 2) throw new Error("JWT malformed: Invalid number of parts for JWT token. expected 3 or 2 (unsecured JWT)!");
+        if (JWTUtil.isEmptyString(jwtParts[0])) throw new Error("JWT malformed: jwt header cannot be empty");
+        if (JWTUtil.isEmptyString(jwtParts[1])) throw new Error("JWT malformed: jwt payload cannot be empty");
+        const jwtHBin = base64url.decode(jwtParts[0], "String"), jwtPBin = base64url.decode(jwtParts[1], "String"), jwtHeader = JSON.parse(jwtHBin), jwtPayload = JSON.parse(jwtPBin);
+        if (this.jwtOptions.issuer && jwtPayload.iss && this.jwtOptions.issuer !== jwtPayload.iss) throw new Error(`JWT malformed: invalid iss, expected ${this.jwtOptions.issuer}`);
+        if (this.jwtOptions.subject && jwtPayload.sub && this.jwtOptions.subject !== jwtPayload.sub) throw new Error(`JWT malformed: invalid sub, expected ${this.jwtOptions.subject}`);
+        if (this.jwtOptions.audience) {
+            const aud = jwtPayload.aud;
+            if (aud && (Array.isArray(aud) || "string" == typeof aud)) {
+                if (!(Array.isArray(aud) ? aud : [ aud ]).includes(this.jwtOptions.audience)) throw new Error(`JWT malformed: invalid aud, expected ${this.jwtOptions.audience}`);
+            }
+        }
+        const clockTimestamp = Math.floor(Date.now() / 1e3);
+        if (!1 === this.jwtOptions.ignoreExpiration) {
+            if ("number" != typeof jwtPayload.exp) throw new Error("JWT malformed: exp must be number");
+            if (jwtPayload.exp && clockTimestamp > jwtPayload.exp + (this.jwtOptions.clockTolerance || 0)) throw new Error("JWT expired");
+        }
+        if (!1 === this.jwtOptions.ignoreNotBefore) {
+            if ("number" != typeof jwtPayload.nbf) throw new Error("JWT malformed: nbf must be number");
+            if (jwtPayload.nbf && jwtPayload.nbf > clockTimestamp + (this.jwtOptions.clockTolerance || 0)) throw new Error("JWT not active");
+        }
+        if (!jwtHeader.alg) throw new Error("JWT malformed: expected alg field in JWT header");
+        if ("NONE" === jwtHeader.alg.toUpperCase()) {
+            if (null === (_a = this.algorithms) || void 0 === _a ? void 0 : _a.includes(jwtHeader.alg.toUpperCase())) return {
+                header: jwtHeader,
+                payload: jwtPayload
+            };
+            throw new Error("Unsecured JWT Token are not allowed");
+        }
+        if (!(null === (_b = this.algorithms) || void 0 === _b ? void 0 : _b.includes(jwtHeader.alg.toUpperCase()))) throw new Error(`${jwtHeader.alg} is not supported at the moment`);
+        for (const cryptoKey of keys) {
+            if (await this.validateSignature(base64JWTToken, jwtParts, jwtHeader.alg.toUpperCase(), cryptoKey)) return {
+                header: jwtHeader,
+                payload: jwtPayload
+            };
+        }
+        throw new Error("JWT token signature verification failed!");
+    }
+    validateOptionTypes() {
+        if (void 0 !== this.jwtOptions.issuer && ("string" != typeof this.jwtOptions.issuer || 0 === this.jwtOptions.issuer.trim().length)) throw new Error("Invalid jwtOptions: issuer must be non empty string");
+        if (void 0 !== this.jwtOptions.audience && ("string" != typeof this.jwtOptions.audience || 0 === this.jwtOptions.audience.trim().length)) throw new Error("Invalid jwtOptions: audience must be non empty string");
+        if (void 0 !== this.jwtOptions.subject && ("string" != typeof this.jwtOptions.subject || 0 === this.jwtOptions.subject.trim().length)) throw new Error("Invalid jwtOptions: subject must be non empty string");
+        if (void 0 === this.jwtOptions.ignoreExpiration) this.jwtOptions.ignoreExpiration = !0; else if ("boolean" != typeof this.jwtOptions.ignoreExpiration) throw new Error("Invalid jwtOptions: ignoreExpiration must be boolean");
+        if (void 0 === this.jwtOptions.ignoreNotBefore) this.jwtOptions.ignoreNotBefore = !0; else if ("boolean" != typeof this.jwtOptions.ignoreNotBefore) throw new Error("Invalid jwtOptions: ignoreNotBefore must be boolean");
+        if (void 0 === this.jwtOptions.allowUnsecuredToken) this.jwtOptions.allowUnsecuredToken = !1; else if ("boolean" != typeof this.jwtOptions.allowUnsecuredToken) throw new Error("Invalid jwtOptions: allowUnsecuredToken must be boolean");
+        if (void 0 === this.jwtOptions.clockTolerance) this.jwtOptions.clockTolerance = 60; else if ("number" != typeof this.jwtOptions.clockTolerance) throw new Error("Invalid jwtOptions: clockTimestamp must be number");
+    }
+    async validateSignature(base64JWTToken, jwtParts, alg, cryptoKey) {
+        switch (alg) {
+          case "RS512":
+          case "RS384":
+          case "RS256":
+            return await crypto.subtle.verify({
+                name: "RSASSA-PKCS1-v1_5"
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "HS512":
+          case "HS384":
+          case "HS256":
+            return await crypto.subtle.verify({
+                name: "HMAC"
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "PS512":
+            return await crypto.subtle.verify({
+                name: "RSA-PSS",
+                saltLength: 64
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "PS384":
+            return await crypto.subtle.verify({
+                name: "RSA-PSS",
+                saltLength: 48
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "PS256":
+            return await crypto.subtle.verify({
+                name: "RSA-PSS",
+                saltLength: 32
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "ES512":
+            return await crypto.subtle.verify({
+                name: "ECDSA",
+                hash: "SHA-512"
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "ES384":
+            return await crypto.subtle.verify({
+                name: "ECDSA",
+                hash: "SHA-384"
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          case "ES256":
+            return await crypto.subtle.verify({
+                name: "ECDSA",
+                hash: "SHA-256"
+            }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
+
+          default:
+            throw new Error(`${alg} is not supported at the moment`);
+        }
+    }
+}
+
+export { JWTValidator };

delivery/common/jwt/examples/jwt-es256/main.js

@@ -0,0 +1,50 @@
+import { logger } from 'log';
+import { JWTValidator} from './jwt.js';
+import { crypto, pem2ab } from 'crypto';
+
+//advanced options for jwt validator
+const jwtOption = {
+  //check token expiry
+  ignoreExpiration: false,
+  //check token nbf
+  ignoreNotBefore: false
+};
+
+const jwtValidator = new JWTValidator(jwtOption);
+
+export async function onClientRequest (request) {
+  try {
+    // Fetch RSA public key from Propery Manager used for verification of JWT token
+    const secretKey = request.getVariable('PMUSER_JWT_ES_PUBKEY');
+    const iKey = await crypto.subtle.importKey(
+      'spki',
+      pem2ab(secretKey),
+      {
+        name: "ECDSA",
+        namedCurve: "P-256"
+      },
+      false,
+      ['verify']
+    );
+    //Fetch the Authorization header from request
+    let jwt = request.getHeader('Authorization');
+    if (jwt){
+      jwt = jwt[0];
+      //replace auth scheme before validating
+      jwt = jwt.replace('Bearer ',''); 
+      const jwtJSON = await jwtValidator.validate(jwt,[iKey]);
+      logger.log('jwtJSON %s: ',JSON.stringify(jwtJSON));
+      const result = {
+        jwt: jwtJSON,
+        verifed: true
+      };
+      request.respondWith(200, {}, JSON.stringify(result));
+    } else {
+      //Return bad request of authorization header is not found
+      request.respondWith(400, {}, 'Authorization header is missing!');
+    }
+  } catch (error) {
+    logger.log(error);
+    request.respondWith(400, {}, error);
+  }
+}

delivery/common/jwt/examples/jwt-hs256/jwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.0.0 */
+/** @preserve @version 1.0.1 */
 import { crypto } from "crypto";
 
 import { base64url, TextEncoder } from "encoding";
@@ -103,25 +103,19 @@ class JWTValidator {
           case "ES512":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-512"
-                }
+                hash: "SHA-512"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES384":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-384"
-                }
+                hash: "SHA-384"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES256":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           default:

delivery/common/jwt/examples/jwt-rs256/jwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.0.0 */
+/** @preserve @version 1.0.1 */
 import { crypto } from "crypto";
 
 import { base64url, TextEncoder } from "encoding";
@@ -103,25 +103,19 @@ class JWTValidator {
           case "ES512":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-512"
-                }
+                hash: "SHA-512"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES384":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-384"
-                }
+                hash: "SHA-384"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES256":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           default:

delivery/common/jwt/examples/typescript/src/jwt/jwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.0.0 */
+/** @preserve @version 1.0.1 */
 import { crypto } from "crypto";
 
 import { base64url, TextEncoder } from "encoding";
@@ -103,25 +103,19 @@ class JWTValidator {
           case "ES512":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-512"
-                }
+                hash: "SHA-512"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES384":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-384"
-                }
+                hash: "SHA-384"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES256":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           default:

delivery/common/jwt/lib/jwt.js

@@ -1,4 +1,4 @@
-/** @preserve @version 1.0.0 */
+/** @preserve @version 1.0.1 */
 import { crypto } from "crypto";
 
 import { base64url, TextEncoder } from "encoding";
@@ -103,25 +103,19 @@ class JWTValidator {
           case "ES512":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-512"
-                }
+                hash: "SHA-512"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES384":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-384"
-                }
+                hash: "SHA-384"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           case "ES256":
             return await crypto.subtle.verify({
                 name: "ECDSA",
-                hash: {
-                    name: "SHA-256"
-                }
+                hash: "SHA-256"
             }, cryptoKey, base64url.decode(jwtParts[2], "Uint8Array").buffer, (new TextEncoder).encode(base64JWTToken.substring(0, jwtParts[0].length + 1 + jwtParts[1].length)));
 
           default: