r-lib / jose

Javascript Object Signing and Encryption for R

jose

JavaScript Object Signing and Encryption

Read and write JSON Web Keys (JWK, rfc7517), generate and verify JSON Web Signatures (JWS, rfc7515) and encode/decode JSON Web Tokens (JWT, rfc7519). These standards provide modern signing and encryption formats that are natively supported by browsers via the JavaScript WebCryptoAPI, and used by services like OAuth 2.0, LetsEncrypt, and Github Apps.

Documentation

Vignettes for the R package:

• Reading/Writing JSON Web Keys (JWK) in R
• Encoding/Decoding JSON Web Tokens (JWT) in R

Specifications and standards:

• JOSE RFC Tracker: https://datatracker.ietf.org/wg/jose/documents/
• Browser WebCryptoAPI API: https://www.w3.org/TR/WebCryptoAPI/#jose
• ACME Protocol (LetsEncrypt): https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.html

JSON Web Keys (JWK)

library(jose)

# generate an ecdsa key
key <- ec_keygen("P-521")
write_jwk(key)
write_jwk(as.list(key)$pubkey)

# Same for RSA
key <- rsa_keygen()
write_jwk(key)
write_jwk(as.list(key)$pubkey)

JSON Web Tokens (JWT)

# HMAC signing
mysecret <- "This is super secret"
token <- jwt_claim(name = "jeroen", session = 123456)
sig <- jwt_encode_hmac(token, mysecret)
jwt_decode_hmac(sig, mysecret)

# RSA encoding
mykey <- openssl::rsa_keygen()
pubkey <- as.list(mykey)$pubkey
sig <- jwt_encode_sig(token, mykey)
jwt_decode_sig(sig, pubkey)

# Same with EC
mykey <- openssl::ec_keygen()
pubkey <- as.list(mykey)$pubkey
sig <- jwt_encode_sig(token, mykey)
jwt_decode_sig(sig, pubkey)

jose's Issues

Add a decoding function that shouldn't use a secret key on a client

Thanks for the package, it works great. The only problem for me is that I'm using R as a client and I don't have the secret key available. I know I can parse the payload data on my own. I just wonder if you could add a decoding function to be used on the client?

I use this client-side angular https://github.com/auth0/angular2-jwt just for reference.

Thanks and let me know what you think.

Patrik

Export jwt_split

I'd like to use the openid-configuration/jwks.json url approach to verify a token, but this requires first determining the unverified claims on the token. It looks like the jwt_split function could be used to do this, but it would also need to return the header (for the kid). Would you be willing to export this function and add the header to the return values?

Another approach could be to create jwt.get_unverified_header and jwt.get_unverified_claims functions similar to Python's jose package.

jwt_claim() discarding empty substructures

We want to encode this structure with jwt_claim() in order to embed a Metabase question in a Shiny application:

{
  "resource": {"question": 4},
  "params": {}, # empty but required
  "exp": 123456789 # current time + 10 minutes

Metabase requires the params key to be present at the top level even if the value is empty. However, line 28 of R/claim.R appears to throw away any empty substructures at the top level of the claim, and on the receiving end after decryption the params key is missing. Our workaround is:

params <- list()
names(params) <- character(0)
claim <- structure(list(exp = unbox(expiry), resource = list(question = unbox(1)), params = params),
                   class = c("jwt_claim", "list"))
token <- jwt_encode_hmac(claim, secret = METABASE_SECRET_KEY)

(We have to contruct params this way rather than simply using a list because jsonlite converts list() without names to [] rather than {}). Can jwt_claim() take an optional argument specifying that empty structures are to be retained?

Cross reference tests

Add decoding tests using jwt's from another source like http://kjur.github.io/jsjws/tool_jwt.html

Test with Github Apps client

Github Apps use jwt for authentication.

OpenSSL error in ASN1_get_object: too long

I am getting the error when the jwt_decode_sig function calls the signature_verify function. Any ideas on where to look at first?

If I copy the jwt_split code and pass the sig through it, it works fine and I can get all of the information out of the JWT signature. However, when I use the jwt_decode_sig function directly, it fails with the error, even though the public key is valid, and I assume the sig is valid.

Allow overriding typ in jwt_encode_sig?

At the moment typ=JWT is hardcoded in jwt_encode_sig

jose/R/jwt.R

Lines 92 to 95 in 648d559

	to_json(c(list(
	typ = "JWT",
	alg = paste0("RS", size)
	), header))

jose/R/jwt.R

Lines 100 to 103 in 648d559

	to_json(c(list(
	typ = "JWT",
	alg = paste0("ES", size)
	), header))

As part of the Solid OIDC specification, I need to be able to use typ=dpop+jwt
https://solid.github.io/solid-oidc/primer/#authorization-code-pkce-flow-step-13

Would there be an objection to allowing typ to be overridden by header, i.e. using modifyList instead of c?

to_json(modifyList(list( 
   typ = "JWT", 
   alg = paste0("ES", size) 
 ), header)) 

I've checked that this would be the only change required to allow jose to be used in implementing Solid OIDC:
https://gist.github.com/josephguillaume/41eed73967e0cf2ff4714b38be55dcfc

Happy to put in the (trivial) PR.

Specify licence

Hallo,

Would it be possible that you choose one of the canonical licences for this package?

Best,
Sebastian

read_jwk from url?

Hi
I think it would be helpful if we could supply an url instead of a file.
What do you think?
Cheers

Move `master` branch to `main`

The master branch of this repository will soon be renamed to main, as part of a coordinated change across several GitHub organizations (including, but not limited to: tidyverse, r-lib, tidymodels, and sol-eng). We anticipate this will happen by the end of September 2021.

That will be preceded by a release of the usethis package, which will gain some functionality around detecting and adapting to a renamed default branch. There will also be a blog post at the time of this master --> main change.

The purpose of this issue is to:

• Help us firm up the list of targetted repositories
• Make sure all maintainers are aware of what's coming
• Give us an issue to close when the job is done
• Give us a place to put advice for collaborators re: how to adapt

message id: euphoric_snowdog

Export all header information from jwt_split

Currently, jwt_split exports only type and keysize as headers. In some situations additional headers are transmitted and required. One example is the kid header when using Google's OpenID Connect. Is there any functionality to parse to the headers? Otherwise, I would propose to export all headers as a sublist of jwt_split.

curve25591 support

See https://datatracker.ietf.org/doc/draft-ietf-jose-cfrg-curves/. We can use the sodium package to implement curve25591 and ed25591.

Allow to configure grace period

The grace period for token validation is currently hard-coded to 60 seconds, see here:

jose/R/jwt.R

Lines 171 to 188 in 429a463

	# As suggested in the spec, we give a 60s grace period to account
	# for inaccurate clocks.
	check_expiration_time <- function(payload){
	if(length(payload$exp)){
	stopifnot("exp claim is a number" = is.numeric(payload$exp))
	expdate <- structure(payload$exp, class = c("POSIXct", "POSIXt"))
	if(expdate < (Sys.time() - 60)){
	stop(paste("Token has expired on", expdate), call. = FALSE)
	}
	}
	if(length(payload$nbf)){
	stopifnot("nbf claim is a number" = is.numeric(payload$nbf))
	nbfdate <- structure(payload$nbf, class = c("POSIXct", "POSIXt"))
	if(nbfdate > (Sys.time() + 60)){
	stop(paste("Token is not valid before", nbfdate), call. = FALSE)
	}
	}
	}

Would it be possible to make this configurable? It would help to test the token expiration functionality.