thoughts/node_modules/jsonwebtoken/test/jwt.rs.tests.js
node_modules/jsonwebtoken/test/jwt.rs.tests.jsRaw
1var jwt = require('../index');
2var fs = require('fs');
3var path = require('path');
4
5var expect = require('chai').expect;
6var assert = require('chai').assert;
7var ms = require('ms');
8
9describe('RS256', function() {
10 var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'));
11 var priv = fs.readFileSync(path.join(__dirname, 'priv.pem'));
12 var invalid_pub = fs.readFileSync(path.join(__dirname, 'invalid_pub.pem'));
13
14 describe('when signing a token', function() {
15 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
16
17 it('should be syntactically valid', function() {
18 expect(token).to.be.a('string');
19 expect(token.split('.')).to.have.length(3);
20 });
21
22 context('asynchronous', function() {
23 it('should validate with public key', function(done) {
24 jwt.verify(token, pub, function(err, decoded) {
25 assert.ok(decoded.foo);
26 assert.equal('bar', decoded.foo);
27 done();
28 });
29 });
30
31 it('should throw with invalid public key', function(done) {
32 jwt.verify(token, invalid_pub, function(err, decoded) {
33 assert.isUndefined(decoded);
34 assert.isNotNull(err);
35 done();
36 });
37 });
38 });
39
40 context('synchronous', function() {
41 it('should validate with public key', function() {
42 var decoded = jwt.verify(token, pub);
43 assert.ok(decoded.foo);
44 assert.equal('bar', decoded.foo);
45 });
46
47 it('should throw with invalid public key', function() {
48 var jwtVerify = jwt.verify.bind(null, token, invalid_pub)
49 assert.throw(jwtVerify, 'invalid signature');
50 });
51 });
52
53 });
54
55 describe('when signing a token with expiration', function() {
56 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresIn: '10m' });
57
58 it('should be valid expiration', function(done) {
59 jwt.verify(token, pub, function(err, decoded) {
60 assert.isNotNull(decoded);
61 assert.isNull(err);
62 done();
63 });
64 });
65
66 it('should be invalid', function(done) {
67 // expired token
68 token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresIn: -1 * ms('10m') });
69
70 jwt.verify(token, pub, function(err, decoded) {
71 assert.isUndefined(decoded);
72 assert.isNotNull(err);
73 assert.equal(err.name, 'TokenExpiredError');
74 assert.instanceOf(err.expiredAt, Date);
75 assert.instanceOf(err, jwt.TokenExpiredError);
76 done();
77 });
78 });
79
80 it('should NOT be invalid', function(done) {
81 // expired token
82 token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresIn: -1 * ms('10m') });
83
84 jwt.verify(token, pub, { ignoreExpiration: true }, function(err, decoded) {
85 assert.ok(decoded.foo);
86 assert.equal('bar', decoded.foo);
87 done();
88 });
89 });
90 });
91
92 describe('when signing a token with not before', function() {
93 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', notBefore: -10 * 3600 });
94
95 it('should be valid expiration', function(done) {
96 jwt.verify(token, pub, function(err, decoded) {
97 assert.isNotNull(decoded);
98 assert.isNull(err);
99 done();
100 });
101 });
102
103 it('should be invalid', function(done) {
104 // not active token
105 token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', notBefore: '10m' });
106
107 jwt.verify(token, pub, function(err, decoded) {
108 assert.isUndefined(decoded);
109 assert.isNotNull(err);
110 assert.equal(err.name, 'NotBeforeError');
111 assert.instanceOf(err.date, Date);
112 assert.instanceOf(err, jwt.NotBeforeError);
113 done();
114 });
115 });
116
117
118 it('should valid when date are equals', function(done) {
119 Date.fix(1451908031);
120
121 token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', notBefore: 0 });
122
123 jwt.verify(token, pub, function(err, decoded) {
124 assert.isNull(err);
125 assert.isNotNull(decoded);
126 Date.unfix();
127 done();
128 });
129 });
130
131 it('should NOT be invalid', function(done) {
132 // not active token
133 token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', notBefore: '10m' });
134
135 jwt.verify(token, pub, { ignoreNotBefore: true }, function(err, decoded) {
136 assert.ok(decoded.foo);
137 assert.equal('bar', decoded.foo);
138 done();
139 });
140 });
141 });
142
143 describe('when signing a token with audience', function() {
144 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', audience: 'urn:foo' });
145
146 it('should check audience', function(done) {
147 jwt.verify(token, pub, { audience: 'urn:foo' }, function(err, decoded) {
148 assert.isNotNull(decoded);
149 assert.isNull(err);
150 done();
151 });
152 });
153
154 it('should check audience in array', function(done) {
155 jwt.verify(token, pub, { audience: ['urn:foo', 'urn:other'] }, function (err, decoded) {
156 assert.isNotNull(decoded);
157 assert.isNull(err);
158 done();
159 });
160 });
161
162 it('should throw when invalid audience', function(done) {
163 jwt.verify(token, pub, { audience: 'urn:wrong' }, function(err, decoded) {
164 assert.isUndefined(decoded);
165 assert.isNotNull(err);
166 assert.equal(err.name, 'JsonWebTokenError');
167 assert.instanceOf(err, jwt.JsonWebTokenError);
168 done();
169 });
170 });
171
172 it('should throw when invalid audience in array', function(done) {
173 jwt.verify(token, pub, { audience: ['urn:wrong', 'urn:morewrong'] }, function(err, decoded) {
174 assert.isUndefined(decoded);
175 assert.isNotNull(err);
176 assert.equal(err.name, 'JsonWebTokenError');
177 assert.instanceOf(err, jwt.JsonWebTokenError);
178 done();
179 });
180 });
181
182 });
183
184 describe('when signing a token with array audience', function() {
185 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', audience: [ 'urn:foo', 'urn:bar' ] });
186
187 it('should check audience', function(done) {
188 jwt.verify(token, pub, { audience: 'urn:foo' }, function(err, decoded) {
189 assert.isNotNull(decoded);
190 assert.isNull(err);
191 done();
192 });
193 });
194
195 it('should check other audience', function(done) {
196 jwt.verify(token, pub, { audience: 'urn:bar' }, function(err, decoded) {
197 assert.isNotNull(decoded);
198 assert.isNull(err);
199 done();
200 });
201 });
202
203 it('should check audience in array', function(done) {
204 jwt.verify(token, pub, { audience: ['urn:foo', 'urn:other'] }, function (err, decoded) {
205 assert.isNotNull(decoded);
206 assert.isNull(err);
207 done();
208 });
209 });
210
211 it('should throw when invalid audience', function(done) {
212 jwt.verify(token, pub, { audience: 'urn:wrong' }, function(err, decoded) {
213 assert.isUndefined(decoded);
214 assert.isNotNull(err);
215 assert.equal(err.name, 'JsonWebTokenError');
216 assert.instanceOf(err, jwt.JsonWebTokenError);
217 done();
218 });
219 });
220
221 it('should throw when invalid audience in array', function(done) {
222 jwt.verify(token, pub, { audience: ['urn:wrong', 'urn:morewrong'] }, function(err, decoded) {
223 assert.isUndefined(decoded);
224 assert.isNotNull(err);
225 assert.equal(err.name, 'JsonWebTokenError');
226 assert.instanceOf(err, jwt.JsonWebTokenError);
227 done();
228 });
229 });
230
231 });
232
233 describe('when signing a token without audience', function() {
234 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
235
236 it('should check audience', function(done) {
237 jwt.verify(token, pub, { audience: 'urn:wrong' }, function(err, decoded) {
238 assert.isUndefined(decoded);
239 assert.isNotNull(err);
240 assert.equal(err.name, 'JsonWebTokenError');
241 assert.instanceOf(err, jwt.JsonWebTokenError);
242 done();
243 });
244 });
245
246 it('should check audience in array', function(done) {
247 jwt.verify(token, pub, { audience: ['urn:wrong', 'urn:morewrong'] }, function(err, decoded) {
248 assert.isUndefined(decoded);
249 assert.isNotNull(err);
250 assert.equal(err.name, 'JsonWebTokenError');
251 assert.instanceOf(err, jwt.JsonWebTokenError);
252 done();
253 });
254 });
255
256 });
257
258 describe('when signing a token with issuer', function() {
259 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', issuer: 'urn:foo' });
260
261 it('should check issuer', function(done) {
262 jwt.verify(token, pub, { issuer: 'urn:foo' }, function(err, decoded) {
263 assert.isNotNull(decoded);
264 assert.isNull(err);
265 done();
266 });
267 });
268
269 it('should check the issuer when providing a list of valid issuers', function(done) {
270 jwt.verify(token, pub, { issuer: [ 'urn:foo', 'urn:bar' ] }, function(err, decoded) {
271 assert.isNotNull(decoded);
272 assert.isNull(err);
273 done();
274 });
275 });
276
277 it('should throw when invalid issuer', function(done) {
278 jwt.verify(token, pub, { issuer: 'urn:wrong' }, function(err, decoded) {
279 assert.isUndefined(decoded);
280 assert.isNotNull(err);
281 assert.equal(err.name, 'JsonWebTokenError');
282 assert.instanceOf(err, jwt.JsonWebTokenError);
283 done();
284 });
285 });
286 });
287
288 describe('when signing a token without issuer', function() {
289 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
290
291 it('should check issuer', function(done) {
292 jwt.verify(token, pub, { issuer: 'urn:foo' }, function(err, decoded) {
293 assert.isUndefined(decoded);
294 assert.isNotNull(err);
295 assert.equal(err.name, 'JsonWebTokenError');
296 assert.instanceOf(err, jwt.JsonWebTokenError);
297 done();
298 });
299 });
300 });
301
302 describe('when signing a token with subject', function() {
303 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', subject: 'subject' });
304
305 it('should check subject', function(done) {
306 jwt.verify(token, pub, { subject: 'subject' }, function(err, decoded) {
307 assert.isNotNull(decoded);
308 assert.isNull(err);
309 done();
310 });
311 });
312
313 it('should throw when invalid subject', function(done) {
314 jwt.verify(token, pub, { subject: 'wrongSubject' }, function(err, decoded) {
315 assert.isUndefined(decoded);
316 assert.isNotNull(err);
317 assert.equal(err.name, 'JsonWebTokenError');
318 assert.instanceOf(err, jwt.JsonWebTokenError);
319 done();
320 });
321 });
322 });
323
324 describe('when signing a token without subject', function() {
325 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
326
327 it('should check subject', function(done) {
328 jwt.verify(token, pub, { subject: 'subject' }, function(err, decoded) {
329 assert.isUndefined(decoded);
330 assert.isNotNull(err);
331 assert.equal(err.name, 'JsonWebTokenError');
332 assert.instanceOf(err, jwt.JsonWebTokenError);
333 done();
334 });
335 });
336 });
337
338 describe('when signing a token with jwt id', function() {
339 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', jwtid: 'jwtid' });
340
341 it('should check jwt id', function(done) {
342 jwt.verify(token, pub, { jwtid: 'jwtid' }, function(err, decoded) {
343 assert.isNotNull(decoded);
344 assert.isNull(err);
345 done();
346 });
347 });
348
349 it('should throw when invalid jwt id', function(done) {
350 jwt.verify(token, pub, { jwtid: 'wrongJwtid' }, function(err, decoded) {
351 assert.isUndefined(decoded);
352 assert.isNotNull(err);
353 assert.equal(err.name, 'JsonWebTokenError');
354 assert.instanceOf(err, jwt.JsonWebTokenError);
355 done();
356 });
357 });
358 });
359
360 describe('when signing a token without jwt id', function() {
361 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
362
363 it('should check jwt id', function(done) {
364 jwt.verify(token, pub, { jwtid: 'jwtid' }, function(err, decoded) {
365 assert.isUndefined(decoded);
366 assert.isNotNull(err);
367 assert.equal(err.name, 'JsonWebTokenError');
368 assert.instanceOf(err, jwt.JsonWebTokenError);
369 done();
370 });
371 });
372 });
373
374 describe('when verifying a malformed token', function() {
375 it('should throw', function(done) {
376 jwt.verify('fruit.fruit.fruit', pub, function(err, decoded) {
377 assert.isUndefined(decoded);
378 assert.isNotNull(err);
379 assert.equal(err.name, 'JsonWebTokenError');
380 done();
381 });
382 });
383 });
384
385 describe('when decoding a jwt token with additional parts', function() {
386 var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
387
388 it('should throw', function(done) {
389 jwt.verify(token + '.foo', pub, function(err, decoded) {
390 assert.isUndefined(decoded);
391 assert.isNotNull(err);
392 done();
393 });
394 });
395 });
396
397 describe('when decoding a invalid jwt token', function() {
398 it('should return null', function(done) {
399 var payload = jwt.decode('whatever.token');
400 assert.isNull(payload);
401 done();
402 });
403 });
404
405 describe('when decoding a valid jwt token', function() {
406 it('should return the payload', function(done) {
407 var obj = { foo: 'bar' };
408 var token = jwt.sign(obj, priv, { algorithm: 'RS256' });
409 var payload = jwt.decode(token);
410 assert.equal(payload.foo, obj.foo);
411 done();
412 });
413 it('should return the header and payload and signature if complete option is set', function(done) {
414 var obj = { foo: 'bar' };
415 var token = jwt.sign(obj, priv, { algorithm: 'RS256' });
416 var decoded = jwt.decode(token, { complete: true });
417 assert.equal(decoded.payload.foo, obj.foo);
418 assert.deepEqual(decoded.header, { typ: 'JWT', alg: 'RS256' });
419 assert.ok(typeof decoded.signature == 'string');
420 done();
421 });
422 });
423});