Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
exports.verify = function (token, pubhex, acceptable) {
// verify JWT
var options = merge(acceptable || {}, { alg: [ALGO] });
var pubKey = new rs.KJUR.crypto.ECDSA({ curve: CURVE });
pubKey.setPublicKeyHex(pubhex);
pubKey.isPrivate = false;
pubKey.isPublic = true;
return rs.jws.JWS.verifyJWT(token, pubKey, options);
};
if (!key && retry && kid) {
let error = 'expected key not found in property jwks. '
+ 'This property is most likely loaded with the '
+ 'discovery document. '
+ 'Expected key id (kid): ' + kid;
console.error(error);
return Promise.reject(error);
}
let keyObj = rs.KEYUTIL.getKey(key);
let validationOptions = {
alg: this.allowedAlgorithms,
gracePeriod: this.gracePeriodInSec
};
let isValid = rs.KJUR.jws.JWS.verifyJWT(params.idToken, keyObj, validationOptions);
if (isValid) {
return Promise.resolve();
}
else {
return Promise.reject('Signature not valid');
}
}
function parseJwt(jwt) {
return jsrsasign.KJUR.jws.JWS.parse(jwt)
}
runHexToPem: function(input, args) {
return r.KJUR.asn1.ASN1Util.getPEMStringFromHex(input.replace(/\s/g, ""), args[0]);
},
calcHash(valueToHash: string, algorithm: string): Promise {
let hashAlg = new rs.KJUR.crypto.MessageDigest({ alg: algorithm });
let result = hashAlg.digestString(valueToHash);
let byteArrayAsString = this.toByteArrayAsString(result);
return Promise.resolve(byteArrayAsString);
}
runHexToObjectIdentifier: function(input, args) {
return r.KJUR.asn1.ASN1Util.oidHexToInt(input.replace(/\s/g, ""));
},
function validateJWT(pem, payload, exp) {
var isValid = false;
if (exp) {
debug("JWT Expiry enabled");
acceptField.verifyAt = rs.KJUR.jws.IntDate.getNow();
try {
isValid = rs.jws.JWS.verifyJWT(payload, pem, acceptField);
} catch(e) {
logger.consoleLog('log', {component: CONSOLE_LOG_TAG_COMP}, e.message );
}
} else {
debug("JWT Expiry disabled");
try {
isValid = rs.jws.JWS.verify(payload, pem, acceptAlg);
} catch(e) {
logger.consoleLog('log', {component: CONSOLE_LOG_TAG_COMP}, e.message );
}
}
return isValid;
}
var server = http.createServer(function(request, response) {
var privateKey = apigee.getVariable(request, "private.privateKey");
var tstamp = rs.KJUR.jws.IntDate.get('now');
//check for custom claims
var customClaims = JSON.parse(apigee.getVariable(request, "claims")) || null;
if (customClaims) {
token = customClaims;
}
token.api_product_list = apigee.getVariable(request, "apiProductList");
token.audience = "microgateway";
token.jti = apigee.getVariable(request, "jti");
token.iss = apigee.getVariable(request, "iss");
token.access_token = apigee.getVariable(request, "apigee.access_token");
token.client_id = apigee.getVariable(request, "apigee.client_id");
token.nbf = tstamp;
token.iat = tstamp;
_updateCertData() {
//get x509 cert data
try {
const x509Path = this.beameStoreServices.getAbsoluteFileName(Config.CertFileNames.X509);
const rs = require('jsrsasign');
const X509 = rs.X509;
const fs = require('fs');
let pemStr = (fs.readFileSync(x509Path)).toString();
let x = new rs.X509();
x.readCertPEM(pemStr);
let hex = X509.pemToHex(pemStr);
let fingerprints = {
'sha1': rs.KJUR.crypto.Util.hashHex(hex, 'sha1'),
'sha256': rs.KJUR.crypto.Util.hashHex(hex, 'sha256')
},
ai = X509.getExtAIAInfo(hex),
alt = X509.getExtSubjectAltName(hex),
keyUsageStr = X509.getExtKeyUsageString(hex),
alg = x.getSignatureAlgorithmField(),
subjectStr = x.getSubjectString();
let subject = {
"commonName": "",
"country": "",
"locality": "",
"state": "",
"organization": ""
};