marioarnt / azure-ad-jwt-lite

Lightweight (13kb) library to validate Microsoft AzureAD. Written in typescript fully-tested with 100% code coverage

Hi there 👋

My name is Mario, I'm an Web Development Engineer, living in Grenoble (French Alps 🏔️)

I have been coding since 2008 out of passion, and professionally for the past 10 years.

Since that time and the advent of Web 2.0, I have witnessed many revolutions, both fruitful and sterile, in the ever-changing world of web development.

From my beginnings with dynamic websites using the MVC paradigm with PHP and MySQL, to complex cloud-native distributed applications, I have experienced numerous technical revolutions:

• the emergence of MVVM and client-side apps, with increasingly powerful browsers.
• the industrialization and automation of delivery, to ship code faster and on a more relaible way.
• the shift to the Cloud, with more automation and considering the Fin and Sec aspects.
• the web back to SSR, and more generally, a new era where we are looking for simplicity and performance, to reduce the digital footprint.
• more recently, the GenAI that can write pretty decent code 🤖

And a lot of others ! the list would be too long, given how much has happened in our Tech microcosm over the past 15 years.

I enjoy learning new things and doing things to the best of my ability. I also love experimenting with new frameworks and techniques to form my own opinions about them.

I also have a passion for teaching and sharing knowledge with younger developers.

Apart from coding, I like:

• ⛷️ skiing
• 🪂 paragliding
• 🧗 climbing
• 🛼 rollerskates
• 🏀 basket-ball

Feel free to reach me mario[AT]arnautou.fr

Any fool can write code that a computer can understand. Good programmers write code that humans can understand.

Martin Fowler

azure-ad-jwt-lite's Issues

Missing await README

Upgrade to jsonwebtoken 9.0.0

Hello,
any chance, the package will be updated to use jsonwebtoken 9.0.0 in the near future?
The current version shows a critical vulnerarbility regarding jwt.verify()

Dependabot has already created a PR with the proposed changes. A test fails though as unverified verify() calls are forbidden since 9.0.0.

Thank you!

Setting discoveryUrl is ignored

When I set the discoveryUrl to v2 url, the URL is ignored and the library is still using the default URL.

const decoded = await verifyAzureToken(test, {
        discoveryUrl: 'https://login.microsoftonline.com/common/discovery/v2.0/keys',
      })

@MarioArnt it seems that the version in npm is not the same as here in repository.

The automated release is failing 🚨

🚨 The automated release from the master branch failed. 🚨

I recommend you give this issue a high priority, so other packages depending on you can benefit from your bug fixes and new features again.

You can find below the list of errors reported by semantic-release. Each one of them has to be resolved in order to automatically publish your package. I’m sure you can fix this 💪.

Errors are usually caused by a misconfiguration or an authentication problem. With each error reported below you will find explanation and guidance to help you to resolve it.

Once all the errors are resolved, semantic-release will release your package the next time you push a commit to the master branch. You can also manually restart the failed CI job that runs semantic-release.

If you are not sure how to resolve this, here are some links that can help you:

• Usage documentation
• Frequently Asked Questions
• Support channels

If those don’t help, or if this issue is reporting something you think isn’t right, you can always ask the humans behind semantic-release.

---

Invalid npm token.

The npm token configured in the NPM_TOKEN environment variable must be a valid token allowing to publish to the registry https://registry.npmjs.org/.

If you are using Two Factor Authentication for your account, set its level to "Authorization only" in your account settings. semantic-release cannot publish with the default "
Authorization and writes" level.

Please make sure to set the NPM_TOKEN environment variable in your CI with the exact value of the npm token.

---

Good luck with your project ✨

Your semantic-release bot 📦🚀

Caching of public keys

Hi,

Are there any plans to cache the Microsoft public keys with an option to expiry/rotate them? It just seems expensive to retrieve the keys for every authentication call.

Cheers