lua-resty-jwt
lua-resty-jwt copied to clipboard
SkyLothar
Validate header claims
I'd like to be able to validate header claims with my claim spec as well -- this could look like:
local claimSpec = {
header = {
alg = validators.equals('HS256'),
kid = validators.equals('MyKeyID'),
custom = validators.equals('other')
},
payload = {
exp = validators.required(validators.opt_is_not_expired()),
}
}
Awesome! By the way, I think it's considered best practice to pin the signing algorithm when verifying a JWT. Otherwise:
- An attacker can change
alg: nonein the header, and a insecure JWT library would validate the JWT - An attacker can use the public key of an asymmetric JWT, and sign a JWT using
alg: HS256or something symmetric and an insecure JWT library would validate the JWT
Not sure how it would look like in this library, but something to look into alongside this improvement.
- We didn't implement the
nonealgorithm. - You can use
set_alg_whitelistfunction to pin one or some signing algorithms.
