Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
}
// Get the public key.
if (!Array.isArray(keysDoc.keys)) {
throw Error("Keys document incorrectly formatted");
}
const key = keysDoc.keys.find((key: any) => {
return key && key.alg === "RS256" && key.kid === header.kid;
});
if (!key) {
throw Error("Cannot find the public key used to sign the token");
}
// Verify the signature.
const signingInput = `${rawHeader}.${rawPayload}`;
if (!rs256.verify(signingInput, signature, jwkToPem(key))) {
throw Error("Token signature did not validate");
}
// Decode the payload.
let payload;
try {
payload = JSON.parse(Buffer.from(rawPayload, "base64").toString());
if (!payload || typeof payload !== "object") {
throw Error("not an object");
}
} catch (err) {
throw Error(`Invalid token payload: ${err.message || err}`);
}
// Verify claims made in the token.
const now = Date.now();
async userFromToken({ idToken, SecurityUser }) {
const jwks = await getJWKs();
const { header } = jwt.decode(idToken, { complete: true });
const jwk = jwks.find(key => key.kid === header.kid);
const token = await verify(idToken, jwkToPem(jwk));
if (token.token_use !== "id") {
const error = new Error("idToken is invalid!");
throw Object.assign(error, {
code: "SECURITY_COGNITO_INVALID_TOKEN"
});
}
const user = await SecurityUser.findOne({ query: { email: token.email } });
if (!user) {
return null;
}
if (attrKeys.some(attr => token.hasOwnProperty(attr))) {
attrKeys.forEach(attr => {
user[updateAttributes[attr]] = token[attr];
const pems = jwkSet.keys.reduce((tmpPems, key) => {
const pem = jwkToPem({
kty: key.kty,
n: key.n,
e: key.e,
})
return { ...tmpPems, [key.kid]: pem }
}, {})