Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
it('should return errors on token signed with wrong secret (verify-failure)', function (done) {
const token = jwt.sign({
template: 'notification',
type: 'test',
uid: uid,
}, nconf.get('secret') + 'aababacaba');
request({
method: 'post',
url: nconf.get('url') + '/email/unsubscribe/' + token,
}, function (err, res) {
assert.ifError(err);
assert.strictEqual(res.statusCode, 403);
done();
});
});
});
});
const { secret } = await createApp(hostname);
db = await getDB(hostname);
runQuery = makeRunQuery(db);
const userData = await runQuery(`
mutation user {
createUser(input: {}) {
id
}
}
`);
userID = userData.data.createUser.id;
token = JSONWebToken.sign({
sub: userID,
isAdmin: true,
}, secret);
});
function generateToken(params = {}) {
return jwt.sign(params, authConfig.secret, {
expiresIn: 86400,
});
}
export function createSessionToken(sessionId) {
return jwt.sign(
{
iat: new Date(Date.UTC(2019, 0, 1, 1, 0, 0)).getTime(),
token: "not-checked",
sessionId,
},
SESSION_KEY
);
}
function getToken(payload = {}) {
return jwt.sign(payload, config.jwt.secret, {
expiresIn: config.jwt.expiresIn
});
}
function getJWT(url: string, clientId: string, tenantId: string, pemFilePath: string, additionalHeaders, isADFSEnabled: boolean) {
var pemFileContent = fs.readFileSync(pemFilePath);
var jwtObject = {
"aud": (`${url}/${!isADFSEnabled ? tenantId : ""}/oauth2/token`).replace(/([^:]\/)\/+/g, "$1"),
"iss": clientId,
"sub": clientId,
"jti": "" + Math.random(),
"nbf": (Math.floor(Date.now()/1000)-1000),
"exp": (Math.floor(Date.now()/1000)+8640000)
};
var token = jwt.sign(jwtObject, pemFileContent,{ algorithm: 'RS256', header :additionalHeaders });
return token;
}
return new Promise((resolve, reject) => {
jwt.sign(
{ email },
JWT_SECRET_KEY,
{ expiresIn: JWT_EXPIRES_IN, subject: String(user.id) },
(error, idToken) => {
if (error) reject(error)
else resolve(idToken)
}
)
})
})
export const createTokens = async (user, secret, refreshSecret) => {
let tokenUser = pick(user, ['id', 'username', 'role']);
tokenUser.fullName = user.firstName ? `${user.firstName} ${user.lastName}` : null;
const createToken = jwt.sign(
{
user: tokenUser
},
secret,
{
expiresIn: '1m'
}
);
const createRefreshToken = jwt.sign(
{
user: user.id
},
refreshSecret,
{
expiresIn: '7d'
}
);
return Promise.all([createToken, createRefreshToken]);
};
_this.save(user, function (error, user) {
if (error) return callback(error, null);
/**
* Create JSON Web Token & Return
*/
var token = jwt.sign({
uid: user._id
}, Config.jwt.secret, {
issuer: Config.jwt.issuer,
expiresInSeconds: Config.jwt.expires_in_seconds
});
return callback(null, {
jwt: token
});
});
});
resp.on('end', () => {
var users = JSON.parse(data);
var user = users[event.userName]; //get the user entry from the db
var userPassHash = user.passHash;
var vfHash = crypto.createHash('sha1').update(event.userPass).digest('hex');
if(userPassHash===vfHash){
//generate JWT to identify this user
var token = jwt.sign({"sub": event.userName,"name": user.name}, process.env.AUTHORIZER_SECRET);
context.succeed({"token": token});
}
else{
context.fail("Invalid credentials");
}
});