Disallowing Validation of Expired Tokens
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- authentication, security
Research direction
Start by tracing the token validation flow and its use of node-jws's verify method. Determine how expiration is currently assessed and define tests for expired tokens being rejected before unnecessary signature processing, while valid-token verification remains unchanged.
Written by the indexing model from the issue text.
Description
The Problem
The library first validates the signature of tokens before assessing their expiration status. This approach results in unnecessary CPU usage, as it not only validates signatures of expired tokens but also decodes them again using the verify method of node-jws. This double processing of expired but correctly signed tokens is inefficient and could be optimized.
The ideal solution
I would like the jsonwebtoken library to first verify if a token has expired before it checks the signature. This approach would improve efficiency and security by immediately discarding tokens that are no longer valid due to expiration.
Alternative
currently, one might manually check the expiration of the token before passing it to the library, but this adds extra steps and complexity to the authentication process.
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
mksglu/context-mode#1200 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
neondatabase/website#5944 ·
-
module: core
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
bigbluebutton/bigbluebutton#25849 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
jaegertracing/jaeger-ui#4506 ·