Skip to content

Commit 6629e77

Browse files
lbalmacedalbalmaceda
committed
accept none as algorithm
1 parent 3e05c56 commit 6629e77

4 files changed

Lines changed: 86 additions & 5 deletions

File tree

‎lib/src/main/java/com/auth0/jwtdecodejava/Utils.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ public static boolean verifyHS(String[] jwtParts, String secret, Algorithm algor
5252

5353
public static String[] splitToken(String token) {
5454
String[] parts = token.split("\\.");
55+
if (parts.length == 2 && token.endsWith(".")) {
56+
//Tokens with alg='none' have empty String as Signature.
57+
parts = new String[]{parts[0], parts[1], ""};
58+
}
5559
if (parts.length != 3) {
5660
throw new JWTException(String.format("The token was expected to have 3 parts, but got %s.", parts.length));
5761
}

‎lib/src/main/java/com/auth0/jwtdecodejava/impl/JWTVerifier.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ private JWTVerifier(Algorithm algorithm, String secret) {
2727
this.claims = new HashMap<>();
2828
}
2929

30+
public static JWTVerifier init() throws IllegalArgumentException {
31+
return init(Algorithm.none, null);
32+
}
33+
3034
public static JWTVerifier init(Algorithm algorithm, String secret) throws IllegalArgumentException {
3135
if (algorithm == null) {
3236
throw new IllegalArgumentException("The Algorithm cannot be null.");
@@ -39,6 +43,10 @@ public static JWTVerifier init(Algorithm algorithm, String secret) throws Illega
3943
throw new IllegalArgumentException(String.format("You can't use the %s algorithm without providing a valid Secret.", algorithm.name()));
4044
}
4145
break;
46+
case none:
47+
if (secret != null) {
48+
throw new IllegalArgumentException("You can't use the Algorithm 'none' with a non-null Secret.");
49+
}
4250
default:
4351
}
4452
return new JWTVerifier(algorithm, secret);
@@ -98,6 +106,10 @@ private void verifySignature(String[] parts) {
98106
throw new SignatureVerificationException(algorithm, e);
99107
}
100108
break;
109+
case none:
110+
if (!parts[2].isEmpty()){
111+
throw new SignatureVerificationException(algorithm);
112+
}
101113
default:
102114
}
103115
}

‎lib/src/test/java/com/auth0/jwtdecodejava/UtilsTest.java‎

Lines changed: 43 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,59 @@
11
package com.auth0.jwtdecodejava;
22

33
import com.auth0.jwtdecodejava.enums.Algorithm;
4+
import com.auth0.jwtdecodejava.exceptions.JWTException;
45
import org.junit.Rule;
56
import org.junit.Test;
67
import org.junit.rules.ExpectedException;
78

8-
import static org.hamcrest.Matchers.is;
9-
import static org.hamcrest.Matchers.notNullValue;
10-
import static org.junit.Assert.assertFalse;
11-
import static org.junit.Assert.assertThat;
12-
import static org.junit.Assert.assertTrue;
9+
import static org.hamcrest.Matchers.*;
10+
import static org.junit.Assert.*;
1311

1412
public class UtilsTest {
1513

1614
@Rule
1715
public ExpectedException exception = ExpectedException.none();
1816

17+
@Test
18+
public void shouldSplitToken() throws Exception {
19+
String token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJhdXRoMCJ9.W1mx_Y0hbAMbPmfW9whT605AAcxB7REFuJiDAHk2Sdc";
20+
String[] parts = Utils.splitToken(token);
21+
22+
assertThat(parts, is(notNullValue()));
23+
assertThat(parts, is(arrayWithSize(3)));
24+
assertThat(parts[0], is("eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0"));
25+
assertThat(parts[1], is("eyJpc3MiOiJhdXRoMCJ9"));
26+
assertThat(parts[2], is("W1mx_Y0hbAMbPmfW9whT605AAcxB7REFuJiDAHk2Sdc"));
27+
}
28+
29+
@Test
30+
public void shouldSplitTokenWithEmptySignature() throws Exception {
31+
String token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJhdXRoMCJ9.";
32+
String[] parts = Utils.splitToken(token);
33+
34+
assertThat(parts, is(notNullValue()));
35+
assertThat(parts, is(arrayWithSize(3)));
36+
assertThat(parts[0], is("eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0"));
37+
assertThat(parts[1], is("eyJpc3MiOiJhdXRoMCJ9"));
38+
assertThat(parts[2], is(isEmptyString()));
39+
}
40+
41+
@Test
42+
public void shouldThrowOnSplitTokenWithMoreThan3Parts() throws Exception {
43+
exception.expect(JWTException.class);
44+
exception.expectMessage("The token was expected to have 3 parts, but got 4.");
45+
String token = "this.has.four.parts";
46+
Utils.splitToken(token);
47+
}
48+
49+
@Test
50+
public void shouldThrowOnSplitTokenWithLessThan3Parts() throws Exception {
51+
exception.expect(JWTException.class);
52+
exception.expectMessage("The token was expected to have 3 parts, but got 2.");
53+
String token = "two.parts";
54+
Utils.splitToken(token);
55+
}
56+
1957
@Test
2058
public void shouldDecodeBase64() throws Exception {
2159
String source = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9";

‎lib/src/test/java/com/auth0/jwtdecodejava/impl/JWTVerifierTest.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,33 @@ public class JWTVerifierTest {
1818
@Rule
1919
public ExpectedException exception = ExpectedException.none();
2020

21+
@Test
22+
public void shouldAcceptNoneAlgorithmWhenUsingDefaultConstructor() throws Exception {
23+
String token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJhdXRoMCJ9.";
24+
JWT jwt = JWTVerifier.init()
25+
.verify(token);
26+
27+
assertThat(jwt, is(notNullValue()));
28+
}
29+
30+
@Test
31+
public void shouldAcceptNoneAlgorithm() throws Exception {
32+
String token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJhdXRoMCJ9.";
33+
JWT jwt = JWTVerifier.init(Algorithm.none, null)
34+
.verify(token);
35+
36+
assertThat(jwt, is(notNullValue()));
37+
}
38+
39+
@Test
40+
public void shouldThrowWhenUsingNoneAlgorithmAndPassingASecret() throws Exception {
41+
exception.expect(IllegalArgumentException.class);
42+
exception.expectMessage("You can't use the Algorithm 'none' with a non-null Secret.");
43+
String token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJhdXRoMCJ9.";
44+
JWTVerifier.init(Algorithm.none, "something")
45+
.verify(token);
46+
}
47+
2148
@Test
2249
public void shouldThrowWhenInitializedWithoutAlgorithm() throws Exception {
2350
exception.expect(IllegalArgumentException.class);

0 commit comments

Comments
 (0)