Skip to content

Commit d810ccb

Browse files
committed
Removed a few things from the readme
1 parent bf5cc3e commit d810ccb

File tree

1 file changed

+41
-54
lines changed

1 file changed

+41
-54
lines changed

README.md

+41-54
Original file line numberDiff line numberDiff line change
@@ -48,29 +48,12 @@ require 'jwt'
4848

4949
The jwt gem natively supports the NONE, HMAC, RSASSA, ECDSA and RSASSA-PSS algorithms via the openssl library. The gem can be extended with additional or alternative implementations of the algorithms via extensions.
5050

51-
Additionally the EdDSA algorithm is supported via a [separate gem](https://rubygems.org/gems/jwt-eddsa).
51+
Additionally the EdDSA algorithm is supported via a the [jwt-eddsa gem](https://rubygems.org/gems/jwt-eddsa).
5252

5353
For safe cryptographic signing, you need to specify the algorithm in the options hash whenever you call `JWT.decode` to ensure that an attacker [cannot bypass the algorithm verification step](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/). **It is strongly recommended that you hard code the algorithm, as you may leave yourself vulnerable by dynamically picking the algorithm**
5454

5555
See: [ JSON Web Algorithms (JWA) 3.1. "alg" (Algorithm) Header Parameter Values for JWS](https://tools.ietf.org/html/rfc7518#section-3.1)
5656

57-
### Deprecation warnings
58-
59-
Deprecation warnings are logged once (`:once` option) by default to avoid spam in logs. Other options are `:silent` to completely silence warnings and `:warn` to log every time a deprecated path is executed.
60-
61-
```ruby
62-
JWT.configuration.deprecation_warnings = :warn # default is :once
63-
```
64-
65-
### Base64 decoding
66-
67-
In the past the gem has been supporting the Base64 decoding specified in [RFC2045](https://www.rfc-editor.org/rfc/rfc2045) allowing newlines and blanks in the base64 encoded payload. In future versions base64 decoding will be stricter and only comply to [RFC4648](https://www.rfc-editor.org/rfc/rfc4648).
68-
69-
The stricter base64 decoding when processing tokens can be done via the `strict_base64_decoding` configuration accessor.
70-
```ruby
71-
JWT.configuration.strict_base64_decoding = true # default is false
72-
```
73-
7457
### **NONE**
7558

7659
* none - unsigned token
@@ -173,7 +156,7 @@ puts decoded_token
173156

174157
### **EdDSA**
175158

176-
This algorithm has since version 3.0 been moved to the [jwt-eddsa](https://rubygems.org/gems/jwt-eddsa) gem.
159+
This algorithm has since version 3.0 been moved to the [jwt-eddsa gem](https://rubygems.org/gems/jwt-eddsa).
177160

178161
### **RSASSA-PSS**
179162

@@ -200,37 +183,6 @@ decoded_token = JWT.decode(token, rsa_public, true, { algorithm: 'PS256' })
200183
puts decoded_token
201184
```
202185

203-
### Add custom header fields
204-
Ruby-jwt gem supports custom [header fields](https://tools.ietf.org/html/rfc7519#section-5)
205-
To add custom header fields you need to pass `header_fields` parameter
206-
207-
```ruby
208-
token = JWT.encode(payload, key, 'HS256', header_fields={})
209-
```
210-
211-
**Example:**
212-
213-
```ruby
214-
215-
payload = { data: 'test' }
216-
217-
# IMPORTANT: set nil as password parameter
218-
token = JWT.encode(payload, nil, 'none', { typ: 'JWT' })
219-
220-
# eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJkYXRhIjoidGVzdCJ9.
221-
puts token
222-
223-
# Set password to nil and validation to false otherwise this won't work
224-
decoded_token = JWT.decode(token, nil, false)
225-
226-
# Array
227-
# [
228-
# {"data"=>"test"}, # payload
229-
# {"typ"=>"JWT", "alg"=>"none"} # header
230-
# ]
231-
puts decoded_token
232-
```
233-
234186
### **Custom algorithms**
235187

236188
When encoding or decoding a token, you can pass in a custom object through the `algorithm` option to handle signing or verification. This custom object must include or extend the `JWT::JWA::SigningAlgorithm` module and implement certain methods:
@@ -262,18 +214,53 @@ token = ::JWT.encode({'pay' => 'load'}, 'secret', CustomHS512Algorithm)
262214
payload, header = ::JWT.decode(token, 'secret', true, algorithm: CustomHS512Algorithm)
263215
```
264216

217+
### Add custom header fields
218+
Ruby-jwt gem supports custom [header fields](https://tools.ietf.org/html/rfc7519#section-5)
219+
To add custom header fields you need to pass `header_fields` parameter
220+
221+
```ruby
222+
token = JWT.encode(payload, key, 'HS256', {})
223+
```
224+
225+
**Example:**
226+
227+
```ruby
228+
229+
payload = { data: 'test' }
230+
231+
# IMPORTANT: set nil as password parameter
232+
token = JWT.encode(payload, nil, 'none', { typ: 'JWT' })
233+
234+
# eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJkYXRhIjoidGVzdCJ9.
235+
puts token
236+
237+
# Set password to nil and validation to false otherwise this won't work
238+
decoded_token = JWT.decode(token, nil, false)
239+
240+
# Array
241+
# [
242+
# {"data"=>"test"}, # payload
243+
# {"typ"=>"JWT", "alg"=>"none"} # header
244+
# ]
245+
puts decoded_token
246+
```
247+
265248
## `JWT::Token` and `JWT::EncodedToken`
266249

267250
The `JWT::Token` and `JWT::EncodedToken` classes can be used to manage your JWTs.
268251

252+
### Signing and encoding a token
269253
```ruby
270254
token = JWT::Token.new(payload: { exp: Time.now.to_i + 60, jti: '1234', sub: "my-subject" }, header: { kid: 'hmac' })
271255
token.sign!(algorithm: 'HS256', key: "secret")
272256

273257
token.jwt # => "eyJhbGciOiJIUzI1N..."
274258
```
275259

276-
The `JWT::EncodedToken` can be used to create a token object that allows verification of signatures and claims
260+
### Verifying and decoding a token
261+
262+
The `JWT::EncodedToken` can be used as a token object that allows verification of signatures and claims.
263+
277264
```ruby
278265
encoded_token = JWT::EncodedToken.new(token.jwt)
279266

@@ -291,14 +278,14 @@ The `JWT::EncodedToken#verify!` method can be used to verify signature and claim
291278
```ruby
292279
encoded_token = JWT::EncodedToken.new(token.jwt)
293280
encoded_token.verify!(signature: {algorithm: 'HS256', key: "secret"})
294-
295281
encoded_token.payload # => { 'exp'=>1234, 'jti'=>'1234", 'sub'=>'my-subject' }
296282
encoded_token.header # {'kid'=>'hmac', 'alg'=>'HS256'}
297283
```
298284

285+
#### Keyfinders
299286
A keyfinder can be used to verify a signature. A keyfinder is an object responding to the `#call` method. The method expects to receive one argument, which is the token to be verified.
300287

301-
An example on using the built-in JWK keyfinder:
288+
An example on using the built-in JWK keyfinder.
302289
```ruby
303290
# Create and sign a token
304291
jwk = JWT::JWK.new(OpenSSL::PKey::RSA.generate(2048))
@@ -312,7 +299,7 @@ encoded_token.verify!(signature: { algorithm: 'RS256', key_finder: key_finder})
312299
encoded_token.payload # => { 'pay' => 'load' }
313300
```
314301

315-
Using a custom keyfinder proc:
302+
Using a custom keyfinder proc.
316303
```ruby
317304
# Create and sign a token
318305
key = OpenSSL::PKey::RSA.generate(2048)

0 commit comments

Comments
 (0)