koajs / koajs/jwt

[feat] Missing jsonwebtoken options in type definitions

Open
#199 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
1.3k
Forks
121
PR merge metrics
No merged PRs in 30d

Description

I was checking the implementation to see if we can utilize the `clockTolerance` option of the `jsonwebtoken` lib. First I was a bit disappointed and thought it was not possible but then I realized that the options passed to the middleware are fully passed on to the `verify` call. Thus, it is indeed possible to set those options provided by the `jsonwebtoken` lib, it's just neither documented not part of the type definitions (I did not verify if those options were added at a later point to the `jsonwebtoken` lib though!)

However, it'd be great if you could add those details.

https://www.npmjs.com/package/jsonwebtoken

Background: in my case the JWT is created by a remote server which provides the `nbf` claim as a unix timestamp with decimals. The `jsonwebtoken` lib uses its internal `clockTimestamp` (rounded down to full seconds) and compares it to the given `nbf`:

https://github.com/auth0/node-jsonwebtoken/blob/bc28861f1fa981ed9c009e29c044a19760a0b128/verify.js#L180C2-L182

What now happens: the remote system creates something like `1695972313.93304`, `verify` boils it down to `1695972313` and - assuming it IS `1695972313` - it complains due to the `payload.nbf > clockTimestamp`.

## Checklist

- [x] I have searched through GitHub issues for similar issues.
- [x] I have completely read through the README and documentation.

Contributor guide

Open the contributing guide

Research direction

Start with the middleware option type definitions and README or documentation, then compare them with the options accepted by jsonwebtoken's verify call, especially clockTolerance. Done means the relevant verify options are represented in the types and documented for middleware users.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
api, backend
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.