andrew-dixon / cb-jwt

ColdBox JSON Web Tokens (JWT)

ColdBox JSON Web Tokens (JWT)

Description

ColdBox Module for encoding and decoding JSON Web Tokens (JWT). This is a port of the CF-JWT-Simple project which itself is a port of the node.js project node-jwt-simple to CFML. It currently supports HmacSHA256, HmacSHA384, and HmacSHA512 signing algorithms.

Usage

The module has three functions, encode, decode and verify.

jwt.encode( payload , key , [ algorithm ] );
jwt.decode( token , key , [ algorithm ] );
jwt.verify( token , key , [ algorithm ] );

Where the payload is a JSON string, the key is a string containing your encoding/decoding password, the token is a string containing the result of a previous JWT encoding and the optional algorithm value is one of HmacSHA256, HmacSHA384 or HmacSHA512 (default).

This could be used within a ColdBox security interceptor to create the JWT (encode), decode the JWT or verify the JWT is valid. When using it in an interceptor you need to declare the property using the lazy injector using the provider keyword, e.g.:

property name="jwt" inject="provider:JWTService@jwt";

cb-jwt's Issues

ACF compatibility issue

I'm just copying this from the forgebox comment thread:

Ryan Potter • 9 months ago
JWTService.cfc line 45 catch(e) should be catch(any e) to make Adobe happy

See: https://www.forgebox.io/view/jwt

Module settings for default key and algorithm

Would it make sense to introduce optional module settings to configure the default key and algorithm to use for all operations? That would simplify the API as I wouldn't have to pass in the key and algorithm every time I called the service.

moduleSettings = {
  jwt : {
    key : 'myKey',
    secretIsBase64 : true,
    algorithm : 'HS512'
  }
};

I can send over a pull for this if you like.

Rebuild forgebox package

Would it be possible to rebuild/reupload the forgebox package? I'm including this library in my project via box.json but I have to apply the previous fix in #2 manually.