I got the following error:

key is invalid or of invalid type

by the following code. I'm not sure if I'm missing anything.

package main

import (
    "fmt"
    "github.com/dgrijalva/jwt-go"
    "time"
)

func main() {
    tokenString, err := CreateJwtToken()
    if err != nil {
        fmt.Println(err)
    }
    fmt.Println(tokenString)
}

func CreateJwtToken() (string, error) {
    token := jwt.New(jwt.SigningMethodHS256)
    token.Claims["foo"] = "bar"
    token.Claims["exp"] = time.Now().Add(time.Hour * 72).Unix()
    tokenString, err := token.SignedString("netdata.io")
    return tokenString, err
}

Another implementation where Claims can be an actual struct.

Used a lot of the same ideas as #66, however rather than making the interface have each check, I went with a interface of Valid() error

This is still a breaking API change for where users access values from the Claims object currently, as they would need to cast to either jwt.MapClaim, or their object.

Example Implementation

The "Can" method on ScopeInfo is really why I want this. Without it, you have to reconstruct the object from a map[string]interface{}

type Claims struct {
    Audience  string `json:"aud,omitempty"`
    Client    string `json:"cid,omitempty"`
    Expiry    int64  `json:"exp,omitempty"`
    Id        string `json:"jti,omitempty"`
    IssuedAt  int64  `json:"iat,omitempty"`
    Issuer    string `json:"iss,omitempty"`
    NotBefore int64  `json:"nbf,omitempty"`
    Scope     Scope  `json:"scope"`
    Subject   string `json:"sub,omitempty"`
}

func (c Claims) Valid() error {
    now := time.Now().Unix()

    if now > c.Expiry {
        return errors.New("token is expired")
    }

    if now < c.NotBefore {
        return errors.New("token is not valid yet")
    }

    return nil
}

type ScopeInfo struct {
    Actions []string `json:"actions"`
}

type Scope struct {
    User ScopeInfo `json:"user"`
}

func (u *ScopeInfo) Can(scopes ...string) bool {
    privledged := true
    for _, scope := range scopes {
        matched := false
        for _, cmp := range u.Actions {
            if scope == cmp {
                matched = true
                break
            }
        }

        if matched == false {
            privledged = false
            break
        }
    }
    return privledged
}

// Creating a token with specific claims
claims := Claims{}
claims.Audience = "https://myapi.com"
claims.Client = "client-id"
claims.Expiry = time.Now().Add(1 * time.Hour).Unix()
claims.IssuedAt = time.Now().Unix()
claims.Issuer = "https://sso.myapi.com"
claims.Scope = Scope{
    User: ScopeInfo{
        Actions: []string{"read"},
    },
}
token := jwt.NewWithClaims(jwt.GetSigningMethod("RS256"), claims)


//Parsing a token
token, err := jwt.ParseWithClaims(activationToken, func(token *jwt.Token) (interface{}, error) {
    if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
        return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
    }
    return apiVerifyKey, nil
}, &Claims{})

if err != nil || token.Valid == false {
    //err handle
}

claims := token.Claims.(*Claims)
if !claims.Scope.User.Can("read") {
    //I can use my structs!
}

#64

Hi,

I believe some of the vulnerabilities mentioned in this article are also applicable to this library:

Critical vulnerabilities in JSON Web Token libraries

Think it would be good to add an argument to the Parse function which tells it which algorithm to use.

ed25519 sign and verify support

Signed-off-by: BluBb-mADe [email protected] Signed-off-by: Vasiliy Tolstov [email protected]

Opening a ticket for discussion. There are several proposed changes that will not be backwards compatible. It makes sense to land them together so we don't have to break integration multiple times. These are the changes I'm thinking of for 3.x:

• Dropping support for passing []byte to the RSA signing methods. Instead, use the helper methods to deserialize your keys first. See #59
• Support for custom types for Claims. See #66 and #73
• Potentially adding support for json.Number, though I haven't fully grokked that yet. I need to re-read the json library documentation. #68
• Potentially moving ParseFromRequest to a sub package and adding some options. This is a very popular request.

Things that look like they can land in 2.x:

• Support for ECDSA signing methods (#74)
• Support for RSASSA-PSS signing methods (#72)

I'm still on the fence about supporting none out of the box, though, if we did it would look something like https://github.com/dgrijalva/jwt-go/pull/34#issuecomment-58966750

Thoughts? Ideas? Did I miss something?

I was trying to upgrade my https://github.com/goware/jwtauth HTTP middleware for jwt auth which uses this package, and came across an issue when I use my own map[string]interface{} type to decode a jwt token.

ie.

package mypkg

type Claims map[string]interface{}
// Claims to have its own methods, including Valid() error method

func decodeExample(tokenString string) (*jwt.Token, error) {
   t, err := jwt.ParseWithClaims(tokenString, Claims{}, keyFunc)
   return t, err
}

I consistently get an error for the same reason as the comment regarding the json decode special case. In my example, the code will hit: https://github.com/dgrijalva/jwt-go/blob/master/parser.go#L58

one solution, is to just use jwt.Parse() without a custom claims, then wrap the type from as, claims := Claims(t.Claims.(MapClaims)) .. which works, however, it will still enforce the Valid() method from MapClaims which I don't want.. so it's a bit more restrictive then what was previously suppoed in 2.x

let me know if you have any suggestions, but I believe the ParseWithClaims() methods needs to be reworked a bit to avoid that special case

This will allow clients to pass, for example, their own instances of rsa.PublicKey if the key is not specified as some flavour of X509 cert. For example, Salesforce just specify the modulus and exponent (https://login.salesforce.com/id/keys)

Hi,

Thank you so much for this project. It's very helpful. I'm just wondering if there is still time to maintain this code. I noticed that https://github.com/auth0/go-jwt-middleware uses a fork due to "jwt-go not being actively maintained" and noticed a few tickets in https://github.com/dgrijalva/jwt-go/issues that mention security issues. An update on project status, or maybe finding someone willing to take over (maybe from the fork auth-0 uses?) would be useful.

Thanks!

See #75

• [x] Drop support for []byte when using RSA signing methods
• [x] Support for custom Claim types
• [x] Migrate ParseFromRequest to a subpackage.
• [x] Modify request parsing API to provide more flexibility.
• [x] Updated release notes and documentation
• [x] Decide on landing #139 (leeway and validation options)

This is non api breaking fix to MapClaims VerifyAudience problem. This could be release as patch version v3.2.1

See these comments; https://github.com/dgrijalva/jwt-go/issues/463#issuecomment-854975451 https://github.com/dgrijalva/jwt-go/issues/463#issuecomment-854979458

this does not change StandardClaims.Audience type as it not a actual problem for StandardClaims.VerifyAudience. Go type system will not allow slice to assigned to string. Problematic part is MapClaims.VerifyAudience which is handling intefaces

According to https://tools.ietf.org/html/rfc7519#section-4.1 the aud claim in StandardClaims should be an array of strings and currently in jwt-go is defined as string.

While merging branches, Github throws me the security alert message shown below.

Severity is 7.5/10.

"jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1"

I am using the library like this:

package main

import (
	"fmt"
	"time"

	"github.com/dgrijalva/jwt-go"
)

var jwtKey = []byte(`
{
    "p": "7KKWYO2Mdmjm1eIAjpMOtcjfYlslYVthVVecxJyq4sr9v9HUxmN-VWCJaDBBb9iTm8zCoRNauiNhgk4vViK56T6Ooo93GHiHsVtpIB9MgL1NZuHoHZtQL6iq1faRp2A5Xca8TrcxQ4k8snHpndjjnrQj1XtvEESzL23lu-S-280",
    "kty": "RSA",
    "q": "rr-eu9klZeYH8D3DZ6OmBlVFCi7dFHx9uepcrHOlxeZJBg9y5882X2Uw_z4OfIBUHNux0yKXkkHhehiM7gSxb7m75ap54LWG35q9JGU2qI_DvlvEgMObqz-YER4satI7LPbIMISHUyqkcN86SA9olVLNK3kDEsukx_LcnKs7bxc",
    "d": "QxO-9QTZtZ7oHIifMBlFInIstI8CYdVobLhbl_OFA8vTygX_ZG5-i-REYaYUJyx_WwHYYI8HsWmbZsrf2rc7Y76E2OCRGuyEK4lA-YeP2FYX09hwuIvYTXc_KErenp6rbo8W0EU49FIYdTk7Szlx9RF-gatOZXVJqM-nHnh3sHm3facnBba94_2L91eIKezJ1VeuWwxpR2sRZzbQdrOI_sPYurIdLZGeTGYF7kKIcgyMydxchRpiKKapXm--sPewNlzw7NMMU5PLXKIc9YA8rKU2G1OgRxVOrleeKiK4zLZY46ry60Lu2zzwLTQL6uyiGIG0f9hp0TYZY8qedShS-Q",
    "e": "AQAB",
    "use": "sig",
    "kid": "sdfasda",
    "qi": "dsVrwVQnK9WigTluBTq5DTHkbRoeKhp67y8i4LaE5hst3vSd_VrFB1aYhJuHD-c0B8cBt-QQbqN7sUit7OiXS8u7iIoIuTTsS0vBexpJpPMv-GGOQnBrc0pyFvLX_HjJqZRBH4ZsBmI4Zfn6E0NCjEuSPfksxYYz4Df62T9jrgM",
    "dp": "tE7bCPZYziz2n0i7JehWEBwEYrySyhFIJDBDCulZqMAGA_COEbDkJYgOi24hnmjHaLLoJrZJroWhGhobJaYGRPze0G1C0UmeE31UqB5RO9OCs_80z8J1oisCKVDdAU1nyNXSzKP4DL74mfwEh7spDdezakrIgPvoER7LK5WL_I0",
    "alg": "RS256",
    "dq": "K79vJsoDEdKX1C4yOEUA8H7ybM00rcdI1n10u_ur2bKAP5Moih4XF6TGsm-_wq2B4UOi7h-v4H67ywxQY9oq7bSK9MFMB9SKMnqTtYPdPi_XqlVhCXdvBl1CXa63IfsFs4kIrxTOqCR5zIQmHBo3bYKwOJzwBwmSdDg5wMMhevs",
    "n": "oYeiPhASwtqH9RhjfaEPxaw3j-iWIwwDvrnIaPgUT9A175fJ10mKWJ4butQPXQJKcGHcOJ88pftcXe_KBW2sGj5VYyFiPzVpU3C5TFITbtseTEo0VCNDisow2no4BVFDj2h95EA9WGwbktyqE0C4Dc2-_iBXJlQuOY_RBlOlEOxRzxEBxMOiolN9X2CfqJ6DpFKR3wr58pbaYGgdzTL6dRA_aJ7P-V7x8_IYFGYqwYjThIXvWOGwWaSR6Q4iA8pwuNOPegJeFxPom0u67vMZ65EU_c0WH4kv8ucqQq7g_GgL2IDmWaRYykiy6OE8G-hHAGIW898IoyHpkW3K5bKiaw"
}
`)

type Claims struct {
	Username string `json:"username"`
	jwt.StandardClaims
}

func main() {
	expirationTime := time.Now().Add(5 * time.Minute)

	claims := &Claims{
		Username: "prakhar",
		StandardClaims: jwt.StandardClaims{
			// In JWT, the expiry time is expressed as unix milliseconds
			ExpiresAt: expirationTime.Unix(),
		},
	}

	// Declare the token with the algorithm used for signing, and the claims
	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
	// Create the JWT string
	tokenString, err := token.SignedString(jwtKey)
	if err != nil {
		fmt.Println(err)
		return
	}

	fmt.Println(tokenString)

	tkn, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
		return jwtKey, nil
	})
	if err != nil {
		if err == jwt.ErrSignatureInvalid {
			fmt.Println(err)
			return
		}
		fmt.Println(err)
	}
	if !tkn.Valid {
		fmt.Println(err)
		return
	}

	// Finally, return the welcome message to the user, along with their
	// username given in the token
	fmt.Printf("Welcome %s!", claims.Username)
}

And its not able to use the key. It fails saying key is invalid. Could you please look into this?

Why am i getting this error?

cannot use time.Now().Add(time.Hour * 24).Unix() (type int64) as type *jwt.Time in field value

Here is what i have

import (
	"github.com/gofiber/fiber/v2"
	"golang.org/x/crypto/bcrypt"
	"github.com/dgrijalva/jwt-go/v4"
	"strconv"
	"time"
)

	payload := jwt.StandardClaims{
		Subject: strconv.Itoa(int(user.Id)),
		ExpiresAt: time.Now().Add(time.Hour * 24).Unix(),
	}

	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, payload).SignedString([]byte("secret"))

What am i doing wrong here???

issue is on this particular line

		ExpiresAt: time.Now().Add(time.Hour * 24).Unix(),

This is my last attempt at contacting the maintainers before I make a public disclosure of this vulnerability whose severity I gauge at medium. If you are a maintainer of this repository, please send me an email to echo '[email protected]' | tr 'b-za' 'a-yz'.

README says "THIS REPOSITORY IS NO LONGER MAINTANED", however many modules still import this repository.

• https://pkg.go.dev/github.com/dgrijalva/jwt-go?tab=importedby

Module deprecation comments are available from Go 1.17: https://golang.org/doc/go1.17 The comment notify the deprecated message to the users.