Verify an already decoded token
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- authentication, security
Research direction
Start with the verify() and decode() entry points described in the issue and trace how verification currently invokes decoding. Define how a decoded token, including its claims and header, can be verified without decoding it again. Done means the API supports this flow while preserving the existing verification behavior and validation.
Written by the indexing model from the issue text.
Description
Describe the problem you'd like to have solved
Be able to verify an already decoded token.
We sometimes decode the token before verification to check if certain claims are present. For example tenant claim of the token is used to determine which jwksuri to use for verification. Also the kid is in the header of the decoded token and is needed to fetch correct key for verification.
Today the verify() function first call decode() internally and then continues to do the actual verification. I would be nice if verify() only did the actual verification and let the caller do the decode().
Describe the ideal solution
verify() function would take a decoded token as argument, or a new function verifyDecoded() could be introduced if overloading is not wanted.
Alternatives and current work-arounds
We could decode the token to get the pre-verify claims and then call verify which then again decodes the token. This works but puts overhead on every request as we always verify the token.
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Automattic/safe-publish#594 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
dream-num/dsh-univer-office#104 ·
-
comp/dashboard invalid P3
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
NousResearch/hermes-agent#121143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
avniproject/avni-webapp#1811 ·
-
area/auroraboot area/webui bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100