ruby-jwt
ruby-jwt copied to clipboard
jwt
A ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard.
Hey there. I found that hash-key order matters. Is this intentional? I would expect these two JWT tokens to be the same: ```ruby jwt1 = JWT.encode({ a: 1, b: 2...
[Heroku-22 stack](https://devcenter.heroku.com/articles/heroku-22-stack#openssl-3) has been released, and it does not support OpenSSL 1.1 but 3.0. The `ruby-jwt` broke with the following error > rsa#set_key= is incompatible with OpenSSL 3.0 `ruby-openssl`v3 [has...
Given the example in the README, I understand that `JWT.decode` can be passed a function to load a JWKS, and will subsequently use that to find the key to match...
The current method for calculating JWK `kid`s is something like ```ruby def generate_kid(ec_keypair) _crv, x_octets, y_octets = keypair_components(ec_keypair) sequence = OpenSSL::ASN1::Sequence([OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(x_octets, BINARY)), OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(y_octets, BINARY))]) OpenSSL::Digest::SHA256.hexdigest(sequence.to_der) end ``` for EC and...
I've created a https://github.com/santhanakarthikeyan/ruby_jwk gem just to support public JWK URL. Could you migrate this feature over here https://github.com/santhanakarthikeyan/ruby_jwk/blob/main/app/controllers/concerns/ruby_jwk/authenticate.rb?
Some improvements for the RSA algorithm: - One step closer to get rid of the algorithm specific methods from `::JWT:SecurityUtils` (Something that was started on #442) - Stricter requirements for...
The update from v2.3 to v2.4 of this gem breaks our gem. This is the error: ``` :281:in `unpack1': invalid base64 (ArgumentError) from /Users/collimarco/.rbenv/versions/3.0.4/lib/ruby/3.0.0/base64.rb:74:in `strict_decode64' from /Users/collimarco/.rbenv/versions/3.0.4/lib/ruby/3.0.0/base64.rb:106:in `urlsafe_decode64' from /Users/collimarco/.rbenv/versions/3.0.4/lib/ruby/gems/3.0.0/gems/jwt-2.4.0/lib/jwt/decode.rb:120:in...
This is a sort of "Lessons Learned" combined with a few suggestions this project might want to consider. ### Story time I have a server that has to verify and...
This is a second attempt of making it possible to extend the token decoding/encoding behaviour. First version of the same idea in #434 For example to support deflating the payload...
This is a bit of an edge case, but it's caused some confusion for us. If a string is given with segments that can be `Base64.urlsafe_decode64` but doesn't match up...
