mirrors/CyberChef
1
0
Fork 0
mirror of https://github.com/gchq/CyberChef.git synced 2025-04-22 07:46:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Tidied up JWT operations

Browse source
This commit is contained in:
n1474335 2018-08-31 13:58:06 +00:00
parent 100b097ace
commit be14d56eae
9 changed files with 147 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/core/config/Categories.json
View file

@ -89,10 +89,10 @@
"Derive EVP key",
"Bcrypt",
"Scrypt",
"Pseudo-Random Number Generator",
"JWT Sign",
"JWT Verify",
"JWT Decode"
"JWT Decode",
"Pseudo-Random Number Generator"
]
},
{

17
src/core/operations/JWTDecode.mjs
View file

@ -6,6 +6,7 @@
import Operation from "../Operation";
import jwt from "jsonwebtoken";
import OperationError from "../errors/OperationError";
/**
* JWT Decode operation
@ -20,12 +21,11 @@ class JWTDecode extends Operation {
this.name = "JWT Decode";
this.module = "Crypto";
this.description = "Decodes a JSON Web Token without checking whether the provided secret / private key is valid.";
this.infoURL = "https://jwt.io";
this.description = "Decodes a JSON Web Token <b>without</b> checking whether the provided secret / private key is valid. Use 'JWT Verify' to check if the signature is valid as well.";
this.infoURL = "https://wikipedia.org/wiki/JSON_Web_Token";
this.inputType = "string";
this.outputType = "JSON";
this.args = [
];
this.args = [];
}
/**
@ -35,9 +35,14 @@ class JWTDecode extends Operation {
*/
run(input, args) {
try {
return jwt.decode(input);
const decoded = jwt.decode(input, {
json: true,
complete: true
});
return decoded.payload;
} catch (err) {
return err;
throw new OperationError(err);
}
}

22
src/core/operations/JWTSign.mjs
View file

@ -6,6 +6,7 @@
import Operation from "../Operation";
import jwt from "jsonwebtoken";
import OperationError from "../errors/OperationError";
/**
* JWT Sign operation
@ -20,18 +21,18 @@ class JWTSign extends Operation {
this.name = "JWT Sign";
this.module = "Crypto";
this.description = "Signs a JSON object as a JSON Web Token using a provided secret / private key.";
this.infoURL = "https://jwt.io/";
this.description = "Signs a JSON object as a JSON Web Token using a provided secret / private key.<br><br>The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.";
this.infoURL = "https://wikipedia.org/wiki/JSON_Web_Token";
this.inputType = "JSON";
this.outputType = "string";
this.args = [
{
name: "Private / Secret Key",
name: "Private/Secret Key",
type: "text",
value: "secret_cat"
value: "secret"
},
{
name: "Signing Algorithm",
name: "Signing algorithm",
type: "option",
value: [
"HS256",
@ -56,7 +57,16 @@ class JWTSign extends Operation {
*/
run(input, args) {
const [key, algorithm] = args;
return jwt.sign(input, key, { algorithm: algorithm === "None" ? "none" : algorithm });
try {
return jwt.sign(input, key, {
algorithm: algorithm === "None" ? "none" : algorithm
});
} catch (err) {
throw new OperationError(`Error: Have you entered the key correctly? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.
${err}`);
}
}
}

19
src/core/operations/JWTVerify.mjs
View file

@ -6,6 +6,7 @@
import Operation from "../Operation";
import jwt from "jsonwebtoken";
import OperationError from "../errors/OperationError";
/**
* JWT Verify operation
@ -20,15 +21,15 @@ class JWTVerify extends Operation {
this.name = "JWT Verify";
this.module = "Crypto";
this.description = "Verifies that a JSON Web Token is valid and has been signed with the provided secret / private key.";
this.infoURL = "https://jwt.io/";
this.description = "Verifies that a JSON Web Token is valid and has been signed with the provided secret / private key.<br><br>The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.";
this.infoURL = "https://wikipedia.org/wiki/JSON_Web_Token";
this.inputType = "string";
this.outputType = "JSON";
this.args = [
{
name: "Private / Secret Key",
name: "Private/Secret Key",
type: "text",
value: "secret_cat"
value: "secret"
},
];
}
@ -42,14 +43,20 @@ class JWTVerify extends Operation {
const [key] = args;
try {
return jwt.verify(input, key, { algorithms: [
const verified = jwt.verify(input, key, { algorithms: [
"HS256",
"HS384",
"HS512",
"none"
]});
if (verified.hasOwnProperty("name") && verified.name === "JsonWebTokenError") {
throw new OperationError(verified.message);
}
return verified;
} catch (err) {
return err;
throw new OperationError(err);
}
}