+++ /dev/null
-var jwt = {};
-
-var JWTInternals = (function() {
-
- // convert a base64url string to hex
- var b64urlmap="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
- function b64urltohex(s) {
- var ret = ""
- var i;
- var k = 0; // b64 state, 0-3
- var slop;
- for(i = 0; i < s.length; ++i) {
- var v = b64urlmap.indexOf(s.charAt(i));
- if(v < 0) continue;
- if(k == 0) {
- ret += int2char(v >> 2);
- slop = v & 3;
- k = 1;
- }
- else if(k == 1) {
- ret += int2char((slop << 2) | (v >> 4));
- slop = v & 0xf;
- k = 2;
- }
- else if(k == 2) {
- ret += int2char(slop);
- ret += int2char(v >> 2);
- slop = v & 3;
- k = 3;
- }
- else {
- ret += int2char((slop << 2) | (v >> 4));
- ret += int2char(v & 0xf);
- k = 0;
- }
- }
- if(k == 1)
- ret += int2char(slop << 2);
- return ret;
- }
-
-
-
- function base64urlencode(arg)
- {
- var s = window.btoa(arg); // Standard base64 encoder
- s = s.split('=')[0]; // Remove any trailing '='s
- s = s.replace(/\+/g, '-'); // 62nd char of encoding
- s = s.replace(/\//g, '_'); // 63rd char of encoding
- // TODO optimize this; we can do much better
- return s;
- }
-
- function base64urldecode(arg)
- {
- var s = arg;
- s = s.replace(/-/g, '+'); // 62nd char of encoding
- s = s.replace(/_/g, '/'); // 63rd char of encoding
- switch (s.length % 4) // Pad with trailing '='s
- {
- case 0: break; // No pad chars in this case
- case 2: s += "=="; break; // Two pad chars
- case 3: s += "="; break; // One pad char
- default: throw new InputException("Illegal base64url string!");
- }
- return window.atob(s); // Standard base64 decoder
- }
-
- function NoSuchAlgorithmException(message) {
- this.message = message;
- this.toString = function() { return "No such algorithm: "+this.message; };
- }
- function NotImplementedException(message) {
- this.message = message;
- this.toString = function() { return "Not implemented: "+this.message; };
- }
- function InputException(message) {
- this.message = message;
- this.toString = function() { return "Malformed input: "+this.message; };
- }
-
- function HMACAlgorithm(hash, key)
- {
- if (hash == "sha256") {
- this.hash = sjcl.hash.sha256;
- } else {
- throw new NoSuchAlgorithmException("HMAC does not support hash " + hash);
- }
- this.key = sjcl.codec.utf8String.toBits(key);
- }
-
- HMACAlgorithm.prototype =
- {
- update: function _update(data)
- {
- this.data = data;
- },
-
- finalize: function _finalize()
- {
- },
-
- sign: function _sign()
- {
- var hmac = new sjcl.misc.hmac(this.key, this.hash);
- var result = hmac.encrypt(this.data);
- return base64urlencode(window.atob(sjcl.codec.base64.fromBits(result)));
- },
-
- verify: function _verify(sig)
- {
- var hmac = new sjcl.misc.hmac(this.key, this.hash);
- var result = hmac.encrypt(this.data);
-
- return base64urlencode(window.atob(sjcl.codec.base64.fromBits(result))) == sig;
- }
- }
-
- function RSASHAAlgorithm(hash, keyPEM)
- {
- if (hash == "sha1") {
- this.hash = "sha1";
- } else if (hash == "sha256") {
- this.hash = "sha256";
- } else {
- throw new NoSuchAlgorithmException("JWT algorithm: " + hash);
- }
- this.keyPEM = keyPEM;
- }
- RSASHAAlgorithm.prototype =
- {
- update: function _update(data)
- {
- this.data = data;
- },
- finalize: function _finalize()
- {
-
- },
- sign: function _sign()
- {
- var rsa = new RSAKey();
- rsa.readPrivateKeyFromPEMString(this.keyPEM);
- var hSig = rsa.signString(this.data, this.hash);
- return base64urlencode(base64urldecode(hex2b64(hSig))); // TODO replace this with hex2b64urlencode!
- },
- verify: function _verify(sig)
- {
- var result = this.keyPEM.verifyString(this.data, b64urltohex(sig));
- return result;
- }
- }
-
- function WebToken(objectStr, algorithm)
- {
- this.objectStr = objectStr;
- this.pkAlgorithm = algorithm;
- }
-
- var WebTokenParser = {
-
- parse: function _parse(input)
- {
- var parts = input.split(".");
- if (parts.length != 3) {
- throw new MalformedWebToken("Must have three parts");
- }
- var token = new WebToken();
- token.headerSegment = parts[0];
- token.payloadSegment = parts[1];
- token.cryptoSegment = parts[2];
-
- token.pkAlgorithm = base64urldecode(parts[0]);
- return token;
- }
- }
-
- function jsonObj(strOrObject)
- {
- if (typeof strOrObject == "string") {
- return JSON.parse(strOrObject);
- }
- return strOrObject;
- }
-
- function constructAlgorithm(jwtAlgStr, key)
- {
- if ("ES256" === jwtAlgStr) {
- throw new NotImplementedException("ECDSA-SHA256 not yet implemented");
- } else if ("ES384" === jwtAlgStr) {
- throw new NotImplementedException("ECDSA-SHA384 not yet implemented");
- } else if ("ES512" === jwtAlgStr) {
- throw new NotImplementedException("ECDSA-SHA512 not yet implemented");
- } else if ("HS256" === jwtAlgStr) {
- return new HMACAlgorithm("sha256", key);
- } else if ("HS384" === jwtAlgStr) {
- throw new NotImplementedException("HMAC-SHA384 not yet implemented");
- } else if ("HS512" === jwtAlgStr) {
- throw new NotImplementedException("HMAC-SHA512 not yet implemented");
- } else if ("RS256" === jwtAlgStr) {
- return new RSASHAAlgorithm("sha256", key);
- } else if ("RS384" === jwtAlgStr) {
- throw new NotImplementedException("RSA-SHA384 not yet implemented");
- } else if ("RS512" === jwtAlgStr) {
- throw new NotImplementedException("RSA-SHA512 not yet implemented");
- } else {
- throw new NoSuchAlgorithmException("Unknown algorithm: " + jwtAlgStr);
- }
- }
-
- WebToken.prototype =
- {
- serialize: function _serialize(key)
- {
- var header = jsonObj(this.pkAlgorithm);
- var jwtAlgStr = header.alg;
- var algorithm = constructAlgorithm(jwtAlgStr, key);
- var algBytes = base64urlencode(this.pkAlgorithm);
- var jsonBytes = base64urlencode(this.objectStr);
-
- var stringToSign = algBytes + "." + jsonBytes;
- algorithm.update(stringToSign);
- var digestValue = algorithm.finalize();
-
- var signatureValue = algorithm.sign();
- return algBytes + "." + jsonBytes + "." + signatureValue;
- },
-
- verify: function _verify(key)
- {
- var header = jsonObj(this.pkAlgorithm);
- var jwtAlgStr = header.alg;
- var algorithm = constructAlgorithm(jwtAlgStr, key);
- algorithm.update(this.headerSegment + "." + this.payloadSegment);
- algorithm.finalize();
- return algorithm.verify(this.cryptoSegment);
- }
- }
-
- jwt.WebToken = WebToken;
- jwt.WebTokenParser = WebTokenParser;
- jwt.base64urlencode = base64urlencode;
- jwt.base64urldecode = base64urldecode;
-})();
Code Review / portal.git / blobdiff