PLT 155 - Introduce jwt signing js backend #1786

Nikpolik · 2023-09-27T11:53:16Z

Description

Added a new signJwt(payload, secret, options) function to allow us to sign tokens.

Updated the hasValidSignature(jwt, secret) method to be able to verify tokens using PEM formatted keys.

The process for signing JWT was heavily inspired from another library cloudflare-worker-jwt and its sign method.

Quick overview of process for signing JWT

JSON.stringify header and payload
URL encode the two strings
Create the first part of the token headerEncoded.payloadEncoded
Import key
Signing using the algorithm provided in the options and encode signature
Return the final JWT headerEncoded.payloadEncoded.signature

Changes implemented

Extract isomorphicAtob to separate file to reuse for key importing.
Extract jwk to crypto algorithm mapping to separate file. This is will be shared between verify and sign.
Create shared importKey function that handles multiple key formats.
Use new importKey function inside hasValidSignature and verifyJWT also added tests for hasValidSignature.
Implement signing procedure described above.
Export new function.
Added tests and updated docs.

Notes

Since we only use RSASSA-PKCS1-v1_5 currently only added support for importing keys formatted jwk,pkcs8,spki and not raw.
~~signJwt was prefixed with unstable since its goal is to be used internally. ~~ marked with JSDocs that will be used internally
~~Isomorphic atob could be imported from @clerk/shared (fix(shared, nextjs): Support importing @clerk/shared in @clerk/backend #1769)~~ Done
In the cloudflare-worker-jwt implementation of the sign method, the IAT (Issued at) field in the payload is updated. I am not sure if this is something that should be handled in the signing process or when we create the payload 🤔 Changed to update IAT.
~~verifyJWT method was not updated since it has its own implementation of hasValidSignature maybe it should use the updated one? This will allow us to use it PEM pem keys also.~~ Fixed and removed duplicate (unused hasValidSignature)

Checklist

npm test runs as expected.
npm run build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Packages affected

changeset-bot · 2023-09-27T11:53:19Z

🦋 Changeset detected

Latest commit: f47a6ba

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@clerk/backend	Patch
@clerk/fastify	Patch
gatsby-plugin-clerk	Patch
@clerk/nextjs	Patch
@clerk/remix	Patch
@clerk/clerk-sdk-node	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

SokratisVidros

@Nikpolik excellent PR description!

Can you please elaborate on the comment about iat? Is this about updating the iat of the token when we compute the signature?

packages/backend/src/shared/isomorphicAtob.ts

Nikpolik · 2023-09-29T10:34:15Z

@Nikpolik excellent PR description!

Can you please elaborate on the comment about iat? Is this about updating the iat of the token when we compute the signature?

Basically overwrite the iat payload.iat = Math.floor(Date.now() / 1000) to make sure that the signed token always has the correct timestamp of when it was signed. After thinking about it more clearly I need to add.

packages/backend/src/tokens/jwt/signJwt.test.ts

georgepsarakis

👏 Nice work! Overall seems fine to me, just not approving since I'm not so well-versed in JS/TS and there might be some subtle issue with crypto I'm missing.

packages/backend/src/tokens/fixtures.ts

georgepsarakis · 2023-10-10T09:55:37Z

packages/backend/src/tokens/jwt/index.ts


 export type { VerifyJwtOptions } from './verifyJwt';
+export type { SignJwtOptions } from './signJwt';


❓ Does it make sense to prefix these options as unstable? Unlikely to be used, but only for semantics purposes.

packages/backend/src/tokens/jwt/signJwt.test.ts

.changeset/cold-bags-watch.md

packages/backend/src/tokens/jwt/assertions.test.ts

packages/backend/src/tokens/jwt/signJwt.ts

packages/backend/src/tokens/jwt/algorithms.ts

dimkl · 2023-10-11T15:46:59Z

Really nice work! 🚀

Also extracted some functionality to scr/tokens/jwt/algorithms so it can be reused in the future and added some spec. Removed constants and tests for ES256, ES384, ES512

This method is marked as internal since it will be only used on other clerk packages for now.

clerk-cookie · 2024-10-12T00:01:31Z

This PR has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

Nikpolik self-assigned this Sep 27, 2023

clerk-cookie added backend sdk-node labels Sep 27, 2023

Nikpolik force-pushed the introduce-jwt-signing-js-backend branch from 9194ca3 to b8128d8 Compare September 27, 2023 12:00

clerk-cookie added the nextjs label Sep 27, 2023

Nikpolik force-pushed the introduce-jwt-signing-js-backend branch from b8128d8 to 5f9a83c Compare September 27, 2023 12:09

SokratisVidros reviewed Sep 28, 2023

View reviewed changes

packages/backend/src/shared/isomorphicAtob.ts Outdated Show resolved Hide resolved

Nikpolik force-pushed the introduce-jwt-signing-js-backend branch from 5f9a83c to 2016926 Compare October 3, 2023 08:37

nikosdouvlis requested review from dimkl and anagstef October 4, 2023 05:51

Nikpolik force-pushed the introduce-jwt-signing-js-backend branch 2 times, most recently from 51b07ba to 7e4189c Compare October 6, 2023 10:02

Nikpolik marked this pull request as ready for review October 6, 2023 10:05

Nikpolik requested a review from a team as a code owner October 6, 2023 10:05

SokratisVidros approved these changes Oct 9, 2023

View reviewed changes

SokratisVidros reviewed Oct 9, 2023

View reviewed changes

packages/backend/src/tokens/jwt/signJwt.test.ts Outdated Show resolved Hide resolved

georgepsarakis reviewed Oct 10, 2023

View reviewed changes

nikosdouvlis approved these changes Oct 10, 2023

View reviewed changes

.changeset/cold-bags-watch.md Outdated Show resolved Hide resolved

dimkl approved these changes Oct 10, 2023

View reviewed changes

Nikpolik force-pushed the introduce-jwt-signing-js-backend branch 3 times, most recently from b5b367e to c251845 Compare October 12, 2023 10:24

Nikpolik added 2 commits October 12, 2023 14:28

refactor(backend): Refactor hasValidSignature to also work with PEM keys

c9cb4ca

Also extracted some functionality to scr/tokens/jwt/algorithms so it can be reused in the future and added some spec. Removed constants and tests for ES256, ES384, ES512

feat(backend): Add new method for signing jwt tokens

f47a6ba

This method is marked as internal since it will be only used on other clerk packages for now.

Nikpolik force-pushed the introduce-jwt-signing-js-backend branch from c251845 to f47a6ba Compare October 12, 2023 11:31

Nikpolik added this pull request to the merge queue Oct 12, 2023

Merged via the queue into main with commit 13e9dfb Oct 12, 2023
5 checks passed

Nikpolik deleted the introduce-jwt-signing-js-backend branch October 12, 2023 12:14

clerk-cookie mentioned this pull request Oct 12, 2023

Version Packages #1867

Merged

clerk locked as resolved and limited conversation to collaborators Oct 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PLT 155 - Introduce jwt signing js backend #1786

PLT 155 - Introduce jwt signing js backend #1786

Nikpolik commented Sep 27, 2023 •

edited by dimkl

Loading

changeset-bot bot commented Sep 27, 2023 •

edited

Loading

SokratisVidros left a comment •

edited

Loading

Nikpolik commented Sep 29, 2023 •

edited

Loading

georgepsarakis left a comment

georgepsarakis Oct 10, 2023

dimkl commented Oct 11, 2023

clerk-cookie commented Oct 12, 2024


		export type { VerifyJwtOptions } from './verifyJwt';
		export type { SignJwtOptions } from './signJwt';

PLT 155 - Introduce jwt signing js backend #1786

PLT 155 - Introduce jwt signing js backend #1786

Conversation

Nikpolik commented Sep 27, 2023 • edited by dimkl Loading

Description

Checklist

Type of change

Packages affected

changeset-bot bot commented Sep 27, 2023 • edited Loading

🦋 Changeset detected

SokratisVidros left a comment • edited Loading

Choose a reason for hiding this comment

Nikpolik commented Sep 29, 2023 • edited Loading

georgepsarakis left a comment

Choose a reason for hiding this comment

georgepsarakis Oct 10, 2023

Choose a reason for hiding this comment

dimkl commented Oct 11, 2023

clerk-cookie commented Oct 12, 2024

Nikpolik commented Sep 27, 2023 •

edited by dimkl

Loading

changeset-bot bot commented Sep 27, 2023 •

edited

Loading

SokratisVidros left a comment •

edited

Loading

Nikpolik commented Sep 29, 2023 •

edited

Loading