Haskell JSON Web Token (JWT)
JSON Web Token (JWT) is a compact URL-safe means of representing claims to be transferred between two parties.
See the Web.JWT module documentation to get started.
- Added support for RSA256 Public Key verification. This in turn means that some
methods are available to verify that are not available to encode; causing a
breaking API change. The
toVerifymethod and the new
VerifySignerare the major changes.
- Add support for Aeson 2.x
- Add “kid” and allow specifying JOSEHeader
- Clean up docs and remove confusing JSON type alias
- Switch from RSA and HsOpenSSL to x509-store
- Add Semigroup instances for GHC 8.6 compatibility
- Support RS256 algorithm
- Add Monoid for ClaimsMap
Thanks to Patrick Brisbin and Brian McKenna for adding support for RS256.
- Add missing Data.ByteString.ExtendedTests (Thanks to nomeata for reporting this).
- Support GHC 8 by raising the upper bound of base (GHC8 ships with base-4.9) (Thanks to Utku Demir).
binarySecretfunction to enable providing a secret based on a
ByteString(fixes #21 - Thanks to Joe Nelson for reporting this).
- Update JWT to match RFC 7519. This is a backward compatible change with
deprecation warnings added for types and functions to be removed in the
- Add NumericDate as a replacement for IntDate (and numericDate as a replacement for intDate)
- Add JOSEHeader as a replacement for JWTHeader.
- Use Stack and LTS 4.0
- Use cryptonite instead of cryptohash (Thanks to Greg V)
- Remove Web.Base64 in favour of using
memory(Thanks to Greg V)
- Execute doctests in addition to the testsuite when using ‘make test’.
ClaimsMaptype alias (fixes #12)
- Allow base 4.8
- Lowered required cabal library version (to 1.16) to workaround build issues in a consumer project.
- Add 7.10.1 to the travis config
- Add the missing
other-modulesfield to the .cabal file so that all the tests are present in the source distribution. Thanks to Richard Wallace for reporting this.
- Tim McLean pointed out that comparing signatures may be susceptible to
a timing attack in the way the signatures were compared (using the default
Eq instance). Both
Secretnow have an
Eqinstance that uses a constant time comparison function. Thanks Tim for reporting this.
- Fix the encoding of the
audpart of the claim. Thanks to Aaron Levin for reporting and implementing the change. In addition to the fix we now also verify the shape fo the generated payload.
- Rev. 17 of the JWT Draft changed the audience claim from being an
optional String to being either an optional
StringOrURIs or an optional list of
StringOrURIs. Thanks to Aaron Levin for reporting and implementing the change. This change breaks backwards compatibility (in regard to 0.4.x).
- Fix the build problems introduced in 0.4.1 to work with the split network package. Thanks to Richard Wallace for fixing this and to Jeremy Shaw for reporting this at the same time.
- Update jwt.cabal to work with the new split network package. Thanks to Jeremy Shaw for reporting this.
- Change the upper boundary of base from 4.7 to 4.8 (#5)
- Add verify function (thanks to Robert Massaioli) to allow verifying an already decoded JWT token
- Add Decoding/Encoding sections
- Make the examples runnable by doctest
- Fix hlint warnings
- Add ‘secondsSinceEpoch’ to extract the seconds from epoch from an IntDate
- Export the IntDate and StringOrURI types #5a1137b
- Verify that invalid input to the decode* functions fails as expected
- Initial release