A JWT encryption and decryption library for node applications
This library provides a more granular encryption as it strives solve the vulnarabilities in the crypto encryption and descryption by using the latest createCipheriv and createDecipheriv as per the deprecation notice on createCipher and createDecipher which is currently semantically insecure for all supported ciphers and fattally flawed for ciphers in counter mode such as (CTR, GCM or CCM).
npm install jwt-encryptor
yarn add jwt-encryptThe encryption algorithms determine the key. The following shows the list algorithms supported and their key and iv(initialization vector) lengths required
| Algorithm | Key Length | IV Length |
|---|---|---|
| aes-256-cbc | 32 | 16 |
| aes-192-cbc | 24 | 16 |
| aes-128-cbc | 16 | 16 |
{
key: string;// a 16-bit, 24-bit, or 32-bit raw string used by the algorithms
iv: string;// a 16-bit raw string initialization vector
algorithm: 'aes-128-cbc'|'aes-192-cbc'|'aes-256-cbc';// The cypher algorithm to be used to encrypt the payload}(Synchronous) Returns the JsonWebToken containing encrypted payload as string
importjwtefrom'jwt-encrypt';consttoken=jwte.sign(payload,jwtSecret,encryptionOptions,jwtOptions);importjwtefrom'jwt-encrypt';constpayload={test: 'test'};constjwtSecret='secret';constencryptionOptions={algorithm: 'aes-256-cbc',iv: 'abcd1234abcd1234',// 16-bit stringkey: 'abcd1234abcd1234efgh5678efgh5678',// 32-bit string};consttoken=jwte.sign(payload,jwtSecret,encryptionOptions,{expiresIn: '1min',});(Synchronously) Decode a given token with encrypted data.
NB: While decoding you must provide the algorithm, key and iv that were used while signing the token
importjwtefrom'jwt-encrypt';constdecoded=jwte.decode(token,encryptionOptions);importjwtefrom'jwt-encrypt';constpayload={test: 'test'};constencryptionOptions={algorithm: 'aes-256-cbc',iv: 'abcd1234abcd1234',// 16-bit stringkey: 'abcd1234abcd1234efgh5678efgh5678',// 32-bit string};constdecoded=jwte.decode(token,encryptionOptions);(Asynchronous) If a callback is supplied, function acts asynchronously. The callback is called with the decoded payload if the signature is valid and optional expiration, audience, or issuer are valid. If not, it will be called with the error.
NB: While verifying you must provide the algorithm, key and iv that were used while signing the token
importjwtefrom'jwt-encrypt';jwte.verify(signedToken,jwtSecret,encryptionOptions,jwtOptions,(err,verifiedToken)=>{});importjwtefrom'jwt-encrypt';constpayload={test: 'test'};constjwtSecret='secret';constencryptionOptions={algorithm: 'aes-256-cbc',iv: 'abcd1234abcd1234',// 16-bit stringkey: 'abcd1234abcd1234efgh5678efgh5678',// 32-bit string};constjwtOptions={};jwte.verify(signedToken,jwtSecret,encryptionOptions,jwtOptions,(err,verifiedToken)=>{if(err){console.log('Error',err);}console.log('VerifiedToken',verifiedToken);});MIT