Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add RS256 support #4

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Conversation

paweldomas
Copy link

Adds basic support for RS256 signature verification.
The 'key' should be passed as a string which contains public key in PEM format for example:

-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcN....................7ogs8j2XThEFa1iPooa
RPE/2+a8z9N1+8d9a....................Ncijm15Z7y/psCAwEAAQ==
-----END PUBLIC KEY-----

It would be great to have a new release available as lua rock if this PR gets merged eventually, thanks !

@EyMaddis
Copy link

EyMaddis commented Jan 4, 2017

I am not sure of the inner workings of
local pubkey = crypto.pkey.from_pem(key), but this might be leading to the the latest security vulnerability:
https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Right now this is not the case as only HMAC based certificates are allowed, but once public keys are used, this has to be considered.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants