1var fs = require('fs');
 2var path = require('path');
 3var jwt = require('../index');
 4var JsonWebTokenError = require('../lib/JsonWebTokenError');
 5var expect = require('chai').expect;
 6
 7
 8var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'), 'utf8');
 9// priv is never used
10// var priv = fs.readFileSync(path.join(__dirname, 'priv.pem'));
11
12var TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIiLCJpYXQiOjE0MjY1NDY5MTl9.ETgkTn8BaxIX4YqvUWVFPmum3moNZ7oARZtSBXb_vP4';
13
14describe('when setting a wrong `header.alg`', function () {
15
16  describe('signing with pub key as symmetric', function () {
17    it('should not verify', function () {
18      expect(function () {
19        jwt.verify(TOKEN, pub);
20      }).to.throw(JsonWebTokenError, /invalid algorithm/);
21    });
22  });
23
24  describe('signing with pub key as HS256 and whitelisting only RS256', function () {
25    it('should not verify', function () {
26      expect(function () {
27        jwt.verify(TOKEN, pub, {algorithms: ['RS256']});
28      }).to.throw(JsonWebTokenError, /invalid algorithm/);
29    });
30  });
31
32  describe('signing with HS256 and checking with HS384', function () {
33    it('should not verify', function () {
34      expect(function () {
35        var token = jwt.sign({foo: 'bar'}, 'secret', {algorithm: 'HS256'});
36        jwt.verify(token, 'some secret', {algorithms: ['HS384']});
37      }).to.throw(JsonWebTokenError, /invalid algorithm/);
38    });
39  });
40
41
42});