luajwt
luajwt copied to clipboard
Add RS256 support
Adds basic support for RS256 signature verification. The 'key' should be passed as a string which contains public key in PEM format for example:
-----BEGIN PUBLIC KEY----- MFwwDQYJKoZIhvcN....................7ogs8j2XThEFa1iPooa RPE/2+a8z9N1+8d9a....................Ncijm15Z7y/psCAwEAAQ== -----END PUBLIC KEY-----
It would be great to have a new release available as lua rock if this PR gets merged eventually, thanks !
I am not sure of the inner workings of
local pubkey = crypto.pkey.from_pem(key), but this might be leading to the the latest security vulnerability:
https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/
Right now this is not the case as only HMAC based certificates are allowed, but once public keys are used, this has to be considered.