Skip to content

v5.0.0

Latest
Latest
Compare
Choose a tag to compare
@ottokruse ottokruse released this 08 Jan 08:41
· 5 commits to main since this release
v5.0.0
b291c6c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

Notable new features in v5.0.0:

  • Support for ECDSA and EdDSA algorithms:
    • ES256
    • ES384
    • ES512
    • Ed25519
    • Ed448
  • Allow padding characters (even though non-standard) so e.g. AWS ALB JWTs can be verified with this library (however work is still underway to make that easier still, see #176 )
  • The default response timeout of the JWKS fetcher was increased from 1500 ms. to 3000 ms. because multiple users reported the previous 1500 ms. being too low--they were hitting timeouts too often. We believe the 3000 ms. is a better, more reasonable, default value.

Breaking changes

This release includes breaking changes, hence moving to major version 5.0.0:

  • Dropped support for Node.js 14, now 16 is the minimum.
  • The fetchJson interface was changed and renamed to fetch. Thus the JsonFetcher was renamed to Fetcher, and corresponding changes were made in the SimpleJwksCache see #167. So, this affects users who were using the SimpleJsonFetcher, potentially to increase the response timeout (maybe that's no longer needed now, as we raised the default value from 1500 ms. to 3000 ms.).
  • It is now allowed to use an explicit null as issuer when creating the verifier, to cater for issuers that create JWTs without iss field (which is non-standard): see #183 . Previously, you couldn't create a verifier for issuer null and JWTs without iss field would always throw JwtInvalidIssuerError. This change likely is breaking to no-one, but technically this is a breaking change. So if your code was explicitly using JwtInvalidIssuerError (e.g. because you imported it), check if it still TS-compiles and works.
  • We renamed the JwtRsaVerifier to JwtVerifier as it handles ECDSA and EdDSA now too but created a top level (immediately deprecated) alias to JwtVerifier so if you do import { JwtRsaVerifier } from "aws-jwt-verifier" that still works. This will break though: import { JwtRsaVerifier } from "aws-jwt-verifier/jwt-rsa" and should become import { JwtVerifier } from "aws-jwt-verifier/jwt-verifier" (if for some reason you were importing like that and not from top-level).

What's Changed

Full Changelog: v4.0.1...v5.0.0

Contributors

ottokruse and dependabot
Assets 2
Loading