Async / custom signers and verifiers
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- javascript
调研方向
从 lib/sign-stream.js 中的算法 resolver 和 signer 入口点开始，然后跟踪 jwsSign opts 的处理方式。当调用方能够提供自定义 resolver 以及返回 Promises 的异步 signer/verifier，并且相关的破坏性 API 变更得到处理时，这项工作就完成了。
由索引模型根据 Issue 内容生成。
描述
Custom (asynchronous) signer/verifier support
When using an external secret store / key management service such as AWS KMS or Azure Key Vault, it is not always possible to have the private key or secret in application memory. Instead, the KMS is used to perform the signing and responds with the signature. As this is an external service it happens asynchronously.
Currently, it is not possible to use these types of asynchronous signing services with the JWS library (at least, not without some circumvention).
Describe the ideal solution
I would like to be able to provide a custom algorithm resolver and to support an asynchronous signer.
The jwsSign opts could take an option that replaces the jwa library for returning a signer/verifier pair. The signer/verifier could then return a Promise that resolves with the signature.
Alternatives and current workarounds
At the moment, the best workaround I can find is to effectively sign the token twice. Once with a random private key that is available in memory and then again using the KMS. The signature from the KMS is then used in place of the one generated in memory.
const { generateKeyPairSync } = require('crypto');
const jws = require('jws');
const keyPair = generateKeyPairSync('rsa', { ... });
async function sign(alg, payload) {
const signature = jws.sign({
header: { alg },
payload,
secret: keyPair.privateKey,
});
const jwsWithoutSig = signature.split('.', 2).join('.');
const sig = await someAsyncSigner(alg, jwsWithoutSig);
return `${jwsWithoutSig}.${sig}`;
}
Additional context
There have been other requests around this type of feature and I think the above proposal is the most generic way to achieve the ability to support async signing.
This should address these related issues: #34, #93
I am happy to work on this solution, but it will involve breaking changes as the sign/verify functions will become async instead of sync.
- 主要语言
- JavaScript
- 星标
- 720
- 派生
- 136
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
auth0/node-jws 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 62/100
-
难度 2/5 1-3 小时 新手友好度 45/100
-
难度 5/5 一周以上 新手友好度 25/100
-
Remove unnecessary safe-buffer dependency (use Node.js built-in Buffer API)可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 2/5 1-3 小时 新手友好度 50/100
-
难度 4/5 3-5 天 新手友好度 25/100
相似的 Issue
-
[Website] Catalog: unknown sort value and mixed-case technology in the URL break the filters可能已有人在做 @barbierajput378-pixel 今天认领。 未关闭area/website framework/jekyll help wanted language/css language/javascript language/markdown
难度 2/5 1-3 小时 新手友好度 80/100
meshery/meshery.io#3088 · 1 条评论 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
firecrawl/firecrawl-mcp-server#548 ·
维护者通常 1 天内回复
-
Area:WebGL p5.js 2.0+
难度 2/5 1-3 小时 新手友好度 78/100
processing/p5.js#9302 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
documentation good first issue hacktoberfest
难度 2/5 1-3 小时 新手友好度 70/100
wassim-azi/agy-powerline#47 ·
维护者通常 1 天内回复