You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+41-54
Original file line number
Diff line number
Diff line change
@@ -48,29 +48,12 @@ require 'jwt'
48
48
49
49
The jwt gem natively supports the NONE, HMAC, RSASSA, ECDSA and RSASSA-PSS algorithms via the openssl library. The gem can be extended with additional or alternative implementations of the algorithms via extensions.
50
50
51
-
Additionally the EdDSA algorithm is supported via a [separate gem](https://rubygems.org/gems/jwt-eddsa).
51
+
Additionally the EdDSA algorithm is supported via a the [jwt-eddsa gem](https://rubygems.org/gems/jwt-eddsa).
52
52
53
53
For safe cryptographic signing, you need to specify the algorithm in the options hash whenever you call `JWT.decode` to ensure that an attacker [cannot bypass the algorithm verification step](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/). **It is strongly recommended that you hard code the algorithm, as you may leave yourself vulnerable by dynamically picking the algorithm**
54
54
55
55
See: [ JSON Web Algorithms (JWA) 3.1. "alg" (Algorithm) Header Parameter Values for JWS](https://tools.ietf.org/html/rfc7518#section-3.1)
56
56
57
-
### Deprecation warnings
58
-
59
-
Deprecation warnings are logged once (`:once` option) by default to avoid spam in logs. Other options are `:silent` to completely silence warnings and `:warn` to log every time a deprecated path is executed.
60
-
61
-
```ruby
62
-
JWT.configuration.deprecation_warnings =:warn# default is :once
63
-
```
64
-
65
-
### Base64 decoding
66
-
67
-
In the past the gem has been supporting the Base64 decoding specified in [RFC2045](https://www.rfc-editor.org/rfc/rfc2045) allowing newlines and blanks in the base64 encoded payload. In future versions base64 decoding will be stricter and only comply to [RFC4648](https://www.rfc-editor.org/rfc/rfc4648).
68
-
69
-
The stricter base64 decoding when processing tokens can be done via the `strict_base64_decoding` configuration accessor.
70
-
```ruby
71
-
JWT.configuration.strict_base64_decoding =true# default is false
72
-
```
73
-
74
57
### **NONE**
75
58
76
59
* none - unsigned token
@@ -173,7 +156,7 @@ puts decoded_token
173
156
174
157
### **EdDSA**
175
158
176
-
This algorithm has since version 3.0 been moved to the [jwt-eddsa](https://rubygems.org/gems/jwt-eddsa) gem.
159
+
This algorithm has since version 3.0 been moved to the [jwt-eddsa gem](https://rubygems.org/gems/jwt-eddsa).
# Set password to nil and validation to false otherwise this won't work
224
-
decoded_token =JWT.decode(token, nil, false)
225
-
226
-
# Array
227
-
# [
228
-
# {"data"=>"test"}, # payload
229
-
# {"typ"=>"JWT", "alg"=>"none"} # header
230
-
# ]
231
-
puts decoded_token
232
-
```
233
-
234
186
### **Custom algorithms**
235
187
236
188
When encoding or decoding a token, you can pass in a custom object through the `algorithm` option to handle signing or verification. This custom object must include or extend the `JWT::JWA::SigningAlgorithm` module and implement certain methods:
A keyfinder can be used to verify a signature. A keyfinder is an object responding to the `#call` method. The method expects to receive one argument, which is the token to be verified.
0 commit comments