api-console-assets

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"> <style> .KEYW {color: #933;} .COMM {color: #bbb; font-style: italic;} .NUMB {color: #393;} .STRN {color: #393;} .REGX {color: #339;} .line {border-right: 1px dotted #666; color: #666; font-style: normal;} </style></head><body><pre> 1 /* jws-3.3.10 (c) 2013-2017 Kenji Urushima | kjur.github.com/jsrsasign/license 2 */ 3 /* 4 * jws.js - JSON Web Signature(JWS) and JSON Web Token(JWT) Class 5 * 6 * Copyright (c) 2010-2017 Kenji Urushima (kenji.urushima@gmail.com) 7 * 8 * This software is licensed under the terms of the MIT License. 9 * https://kjur.github.io/jsrsasign/license/ 10 * 11 * The above copyright and license notice shall be 12 * included in all copies or substantial portions of the Software. 13 */ 14 15 /** 16 * @fileOverview 17 * @name jws-3.3.js 18 * @author Kenji Urushima kenji.urushima@gmail.com 19 * @version jsrsasign 8.0.3 jws 3.3.10 (2017-Jul-11) 20 * @since jsjws 1.0, jsrsasign 4.8.0 21 * @license <a href="https://kjur.github.io/jsrsasign/license/">MIT License</a> 22 */ 23 24 if (typeof KJUR == "undefined" || !KJUR) KJUR = {}; 25 26 /** 27 * kjur's JSON Web Signature/Token(JWS/JWT) library name space 28 * 29 * This namespace privides following JWS/JWS related classes. 30 * <ul> 31 * <li>{@link KJUR.jws.JWS} - JSON Web Signature/Token(JWS/JWT) class</li> 32 * <li>{@link KJUR.jws.JWSJS} - JWS JSON Serialization(JWSJS) class</li> 33 * <li>{@link KJUR.jws.IntDate} - UNIX origin time utility class</li> 34 * </ul> 35 * NOTE: Please ignore method summary and document of this namespace. This caused by a bug of jsdoc2. 36 * 37 * @name KJUR.jws 38 * @namespace 39 */ 40 if (typeof KJUR.jws == "undefined" || !KJUR.jws) KJUR.jws = {}; 41 42 /** 43 * JSON Web Signature(JWS) class. 44 * @name KJUR.jws.JWS 45 * @class JSON Web Signature(JWS) class 46 * @see <a href="https://kjur.github.io/jsjws/">'jwjws'(JWS JavaScript Library) home page https://kjur.github.io/jsjws/</a> 47 * @see <a href="https://kjur.github.io/jsrsasigns/">'jwrsasign'(RSA Sign JavaScript Library) home page https://kjur.github.io/jsrsasign/</a> 48 * @see <a href="http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14">IETF I-D JSON Web Algorithms (JWA)</a> 49 * @since jsjws 1.0 50 * @description 51 * This class provides JSON Web Signature(JWS)/JSON Web Token(JWT) signing and validation. 52 * 53 * <h4>METHOD SUMMARY</h4> 54 * Here is major methods of {@link KJUR.jws.JWS} class. 55 * <ul> 56 * <li>SIGN 57 * <li>{@link KJUR.jws.JWS.sign} - sign JWS</li> 58 * </li> 59 * <li>VERIFY 60 * <li>{@link KJUR.jws.JWS.verify} - verify JWS signature</li> 61 * <li>{@link KJUR.jws.JWS.verifyJWT} - verify properties of JWT token at specified time</li> 62 * </li> 63 * <li>UTILITY 64 * <li>{@link KJUR.jws.JWS.getJWKthumbprint} - get RFC 7638 JWK thumbprint</li> 65 * <li>{@link KJUR.jws.JWS.isSafeJSONString} - check whether safe JSON string or not</li> 66 * <li>{@link KJUR.jws.JWS.readSafeJSONString} - read safe JSON string only</li> 67 * </li> 68 * </ul> 69 * 70 * <h4>SUPPORTED SIGNATURE ALGORITHMS</h4> 71 * Here is supported algorithm names for {@link KJUR.jws.JWS.sign} and 72 * {@link KJUR.jws.JWS.verify} methods. 73 * <table> 74 * <tr><th>alg value</th><th>spec requirement</th><th>jsjws support</th></tr> 75 * <tr><td>HS256</td><td>REQUIRED</td><td>SUPPORTED</td></tr> 76 * <tr><td>HS384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 77 * <tr><td>HS512</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 78 * <tr><td>RS256</td><td>RECOMMENDED</td><td>SUPPORTED</td></tr> 79 * <tr><td>RS384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 80 * <tr><td>RS512</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 81 * <tr><td>ES256</td><td>RECOMMENDED+</td><td>SUPPORTED</td></tr> 82 * <tr><td>ES384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 83 * <tr><td>ES512</td><td>OPTIONAL</td><td>-</td></tr> 84 * <tr><td>PS256</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 85 * <tr><td>PS384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 86 * <tr><td>PS512</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 87 * <tr><td>none</td><td>REQUIRED</td><td>SUPPORTED(signature generation only)</td></tr> 88 * </table> 89 * <dl> 90 * <dt>NOTE1 91 * <dd>HS384 is supported since jsjws 3.0.2 with jsrsasign 4.1.4. 92 * <dt>NOTE2 93 * <dd>Some deprecated methods have been removed since jws 3.3 of jsrsasign 4.10.0. 94 * Removed methods are following: 95 * <ul> 96 * <li>JWS.verifyJWSByNE</li> 97 * <li>JWS.verifyJWSByKey</li> 98 * <li>JWS.generateJWSByNED</li> 99 * <li>JWS.generateJWSByKey</li> 100 * <li>JWS.generateJWSByP1PrvKey</li> 101 * </ul> 102 * </dl> 103 * EXAMPLE 104 * @example 105 * // JWS signing 106 * sJWS = KJUR.jws.JWS.sign(null, '{"alg":"HS256", "cty":"JWT"}', '{"age": 21}', {"utf8": "password"}); 107 * // JWS validation 108 * isValid = KJUR.jws.JWS.verify('eyJjdHkiOiJKV1QiLCJhbGc...', {"utf8": "password"}); 109 * // JWT validation 110 * isValid = KJUR.jws.JWS.verifyJWT('eyJh...', {"utf8": "password"}, { 111 * alg: ['HS256', 'HS384'], 112 * iss: ['http://foo.com'] 113 * }); 114 */ 115 KJUR.jws.JWS = function() { 116 var _KJUR = KJUR, 117 _KJUR_jws_JWS = _KJUR.jws.JWS, 118 _isSafeJSONString = _KJUR_jws_JWS.isSafeJSONString; 119 120 // === utility ============================================================= 121 122 /** 123 * parse JWS string and set public property 'parsedJWS' dictionary. 124 * @name parseJWS 125 * @memberOf KJUR.jws.JWS 126 * @function 127 * @param {String} sJWS JWS signature string to be parsed. 128 * @throws if sJWS is not comma separated string such like "Header.Payload.Signature". 129 * @throws if JWS Header is a malformed JSON string. 130 * @since jws 1.1 131 */ 132 this.parseJWS = function(sJWS, sigValNotNeeded) { 133 if ((this.parsedJWS !== undefined) && 134 (sigValNotNeeded || (this.parsedJWS.sigvalH !== undefined))) { 135 return; 136 } 137 var matchResult = sJWS.match(/^([^.]+)\.([^.]+)\.([^.]+)$/); 138 if (matchResult == null) { 139 throw "JWS signature is not a form of 'Head.Payload.SigValue'."; 140 } 141 var b6Head = matchResult[1]; 142 var b6Payload = matchResult[2]; 143 var b6SigVal = matchResult[3]; 144 var sSI = b6Head + "." + b6Payload; 145 this.parsedJWS = {}; 146 this.parsedJWS.headB64U = b6Head; 147 this.parsedJWS.payloadB64U = b6Payload; 148 this.parsedJWS.sigvalB64U = b6SigVal; 149 this.parsedJWS.si = sSI; 150 151 if (!sigValNotNeeded) { 152 var hSigVal = b64utohex(b6SigVal); 153 var biSigVal = parseBigInt(hSigVal, 16); 154 this.parsedJWS.sigvalH = hSigVal; 155 this.parsedJWS.sigvalBI = biSigVal; 156 } 157 158 var sHead = b64utoutf8(b6Head); 159 var sPayload = b64utoutf8(b6Payload); 160 this.parsedJWS.headS = sHead; 161 this.parsedJWS.payloadS = sPayload; 162 163 if (! _isSafeJSONString(sHead, this.parsedJWS, 'headP')) 164 throw "malformed JSON string for JWS Head: " + sHead; 165 }; 166 }; 167 168 // === major static method ======================================================== 169 170 /** 171 * generate JWS signature by specified key 172 * @name sign 173 * @memberOf KJUR.jws.JWS 174 * @function 175 * @static 176 * @param {String} alg JWS algorithm name to sign and force set to sHead or null 177 * @param {String} spHead string or object of JWS Header 178 * @param {String} spPayload string or object of JWS Payload 179 * @param {String} key string of private key or mac key object to sign 180 * @param {String} pass (OPTION)passcode to use encrypted asymmetric private key 181 * @return {String} JWS signature string 182 * @since jws 3.0.0 183 * @see <a href="https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Signature.html">jsrsasign KJUR.crypto.Signature method</a> 184 * @see <a href="https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Mac.html">jsrsasign KJUR.crypto.Mac method</a> 185 * @description 186 * This method supports following algorithms. 187 * <table> 188 * <tr><th>alg value</th><th>spec requirement</th><th>jsjws support</th></tr> 189 * <tr><td>HS256</td><td>REQUIRED</td><td>SUPPORTED</td></tr> 190 * <tr><td>HS384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 191 * <tr><td>HS512</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 192 * <tr><td>RS256</td><td>RECOMMENDED</td><td>SUPPORTED</td></tr> 193 * <tr><td>RS384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 194 * <tr><td>RS512</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 195 * <tr><td>ES256</td><td>RECOMMENDED+</td><td>SUPPORTED</td></tr> 196 * <tr><td>ES384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 197 * <tr><td>ES512</td><td>OPTIONAL</td><td>-</td></tr> 198 * <tr><td>PS256</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 199 * <tr><td>PS384</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 200 * <tr><td>PS512</td><td>OPTIONAL</td><td>SUPPORTED</td></tr> 201 * <tr><td>none</td><td>REQUIRED</td><td>SUPPORTED(signature generation only)</td></tr> 202 * </table> 203 * <dl> 204 * <dt>NOTE1: 205 * <dd>salt length of RSAPSS signature is the same as the hash algorithm length 206 * because of <a href="http://www.ietf.org/mail-archive/web/jose/current/msg02901.html">IETF JOSE ML discussion</a>. 207 * <dt>NOTE2: 208 * <dd>To support HS384, patched version of CryptoJS is used. 209 * <a href="https://code.google.com/p/crypto-js/issues/detail?id=84">See here for detail</a>. 210 * <dt>NOTE3: 211 * From jsrsasign 4.10.0 jws 3.3.0, Way to provide password 212 * for HS* algorithm is changed. The 'key' attribute value is 213 * passed to {@link KJUR.crypto.Mac.setPassword} so please see 214 * {@link KJUR.crypto.Mac.setPassword} for detail. 215 * As for backword compatibility, if key is a string, has even length and 216 * 0..9, A-F or a-f characters, key string is treated as a hexadecimal 217 * otherwise it is treated as a raw string. 218 * <dd> 219 * </dl> 220 * EXAMPLE 221 * @example 222 * // sign HS256 signature with password "aaa" implicitly handled as string 223 * sJWS = KJUR.jws.JWS.sign(null, {alg: "HS256", cty: "JWT"}, {age: 21}, "aaa"); 224 * // sign HS256 signature with password "6161" implicitly handled as hex 225 * sJWS = KJUR.jws.JWS.sign(null, {alg: "HS256", cty: "JWT"}, {age: 21}, "6161"); 226 * // sign HS256 signature with base64 password 227 * sJWS = KJUR.jws.JWS.sign(null, {alg: "HS256"}, {age: 21}, {b64: "Mi/8..a="}); 228 * // sign RS256 signature with PKCS#8 PEM RSA private key 229 * sJWS = KJUR.jws.JWS.sign(null, {alg: "RS256"}, {age: 21}, "-----BEGIN PRIVATE KEY..."); 230 * // sign RS256 signature with PKCS#8 PEM ECC private key with passcode 231 * sJWS = KJUR.jws.JWS.sign(null, {alg: "ES256"}, {age: 21}, 232 * "-----BEGIN PRIVATE KEY...", "keypass"); 233 * // header and payload can be passed by both string and object 234 * sJWS = KJUR.jws.JWS.sign(null, '{alg:"HS256",cty:"JWT"}', '{age:21}', "aaa"); 235 */ 236 KJUR.jws.JWS.sign = function(alg, spHeader, spPayload, key, pass) { 237 var _KJUR = KJUR, 238 _KJUR_jws = _KJUR.jws, 239 _KJUR_jws_JWS = _KJUR_jws.JWS, 240 _readSafeJSONString = _KJUR_jws_JWS.readSafeJSONString, 241 _isSafeJSONString = _KJUR_jws_JWS.isSafeJSONString, 242 _KJUR_crypto = _KJUR.crypto, 243 _ECDSA = _KJUR_crypto.ECDSA, 244 _Mac = _KJUR_crypto.Mac, 245 _Signature = _KJUR_crypto.Signature, 246 _JSON = JSON; 247 248 var sHeader, pHeader, sPayload; 249 250 // 1. check signatureInput(Header, Payload) is string or object 251 if (typeof spHeader != 'string' && typeof spHeader != 'object') 252 throw "spHeader must be JSON string or object: " + spHeader; 253 254 if (typeof spHeader == 'object') { 255 pHeader = spHeader; 256 sHeader = _JSON.stringify(pHeader); 257 } 258 259 if (typeof spHeader == 'string') { 260 sHeader = spHeader; 261 if (! _isSafeJSONString(sHeader)) 262 throw "JWS Head is not safe JSON string: " + sHeader; 263 pHeader = _readSafeJSONString(sHeader); 264 265 } 266 267 sPayload = spPayload; 268 if (typeof spPayload == 'object') sPayload = _JSON.stringify(spPayload); 269 270 // 2. use alg if defined in sHeader 271 if ((alg == '' || alg == null) && 272 pHeader['alg'] !== undefined) { 273 alg = pHeader['alg']; 274 } 275 276 // 3. update sHeader to add alg if alg undefined 277 if ((alg != '' && alg != null) && 278 pHeader['alg'] === undefined) { 279 pHeader['alg'] = alg; 280 sHeader = _JSON.stringify(pHeader); 281 } 282 283 // 4. check explicit algorithm doesn't match with JWS header. 284 if (alg !== pHeader.alg) 285 throw "alg and sHeader.alg doesn't match: " + alg + "!=" + pHeader.alg; 286 287 // 5. set signature algorithm like SHA1withRSA 288 var sigAlg = null; 289 if (_KJUR_jws_JWS.jwsalg2sigalg[alg] === undefined) { 290 throw "unsupported alg name: " + alg; 291 } else { 292 sigAlg = _KJUR_jws_JWS.jwsalg2sigalg[alg]; 293 } 294 295 var uHeader = utf8tob64u(sHeader); 296 var uPayload = utf8tob64u(sPayload); 297 var uSignatureInput = uHeader + "." + uPayload 298 // 6. sign 299 var hSig = ""; 300 if (sigAlg.substr(0, 4) == "Hmac") { 301 if (key === undefined) 302 throw "mac key shall be specified for HS* alg"; 303 //alert("sigAlg=" + sigAlg); 304 var mac = new _Mac({'alg': sigAlg, 'prov': 'cryptojs', 'pass': key}); 305 mac.updateString(uSignatureInput); 306 hSig</sp