2.1.3

Think the installation command shouldn't use `-D` as it's used in the production code right, so installing as dev dep would be confusing, right?

Please correct me if I'm wrong 🙏

Also thanks a lot for this package, was just using for a way to sign and verify JWT in Pages ❤️

README.md

@@ -16,7 +16,7 @@ A lightweight JWT implementation with ZERO dependencies for Cloudflare Workers.
 ## Install
 
 ```
-npm i -D @tsndr/cloudflare-worker-jwt
+npm i @tsndr/cloudflare-worker-jwt
 ```
 
 
@@ -84,7 +84,7 @@ Signs a payload and returns the token.
 
 #### Arguments
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `payload`   | `object` | required | -       | The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
 `secret`    | `string` | required | -       | A string which is used to sign the payload.
@@ -100,7 +100,7 @@ Returns token as a `string`.
 
 Verifies the integrity of the token and returns a boolean value.
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 `secret`    | `string` | required | -       | The string which was used to sign the payload.
@@ -119,7 +119,7 @@ Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherw
 
 Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 
@@ -147,4 +147,4 @@ Returns an `object` containing `header` and `payload`:
  - HS512
  - RS256
  - RS384
- - RS512
+ - RS512

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.1.0",
+  "version": "2.1.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@tsndr/cloudflare-worker-jwt",
-      "version": "2.1.0",
+      "version": "2.1.3",
       "license": "MIT",
       "devDependencies": {
         "@cloudflare/workers-types": "^3.13.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.1.0",
+  "version": "2.1.3",
   "description": "A lightweight JWT implementation with ZERO dependencies for Cloudflare Worker",
   "main": "index.js",
   "types": "index.d.ts",

src/index.ts

@@ -21,7 +21,7 @@ export interface JwtAlgorithms {
 export interface JwtHeader {
     /**
      * Type (default: `"JWT"`)
-     * 
+     *
      * @default "JWT"
      */
     typ?: string
@@ -89,7 +89,7 @@ export interface JwtSignOptions extends JwtOptions {
 export interface JwtVerifyOptions extends JwtOptions {
     /**
      * If `true` throw error if checks fail. (default: `false`)
-     * 
+     *
      * @default false
     */
     throwError?: boolean
@@ -129,17 +129,6 @@ const algorithms: JwtAlgorithms = {
     RS512: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-512' } }
 }
 
-function _parseSecret(secret: string): { raw: boolean, key: ArrayBuffer } {
-    if (secret.startsWith('-----BEGIN'))
-        return { raw: false, key: _str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, '')) }
-
-    // Check for Base64
-    if (/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/.test(secret))
-        return { raw: true, key: base64UrlParse(secret) }
-    else
-        return { raw: true, key: _utf8ToUint8Array(secret) }
-}
-
 function _utf8ToUint8Array(str: string): Uint8Array {
     return base64UrlParse(btoa(unescape(encodeURIComponent(str))))
 }
@@ -180,7 +169,7 @@ function _decodePayload(raw: string): JwtHeader | JwtPayload | null {
 
 /**
  * Signs a payload and returns the token
- * 
+ *
  * @param {JwtPayload} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
  * @param {string} secret A string which is used to sign the payload.
  * @param {JwtSignOptions | JwtAlgorithm | string} [options={ algorithm: 'HS256', header: { typ: 'JWT' } }] The options object or the algorithm.
@@ -211,9 +200,14 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
 
     const payloadAsJSON = JSON.stringify(payload)
     const partialToken = `${base64UrlStringify(_utf8ToUint8Array(JSON.stringify({ ...options.header, alg: options.algorithm })))}.${base64UrlStringify(_utf8ToUint8Array(payloadAsJSON))}`
-    const parsedSecret = _parseSecret(secret)
-
-    const key = await crypto.subtle.importKey(parsedSecret.raw ? 'raw' : 'pkcs8', parsedSecret.key, algorithm, false, ['sign'])
+    let keyFormat = 'raw'
+    let keyData
+    if (secret.startsWith('-----BEGIN')) {
+        keyFormat = 'pkcs8'
+        keyData = _str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
+    } else
+        keyData = _utf8ToUint8Array(secret)
+    const key = await crypto.subtle.importKey(keyFormat, keyData, algorithm, false, ['sign'])
     const signature = await crypto.subtle.sign(algorithm, key, _utf8ToUint8Array(partialToken))
 
     return `${partialToken}.${base64UrlStringify(new Uint8Array(signature))}`
@@ -221,12 +215,12 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
 
 /**
  * Verifies the integrity of the token and returns a boolean value.
- * 
+ *
  * @param {string} token The token string generated by `jwt.sign()`.
  * @param {string} secret The string which was used to sign the payload.
  * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
  * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
- * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
+ * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`.
  */
 export async function verify(token: string, secret: string, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', throwError: false }): Promise<boolean> {
     if (typeof options === 'string')
@@ -275,16 +269,20 @@ export async function verify(token: string, secret: string, options: JwtVerifyOp
 
         return false
     }
-
-    const parsedSecret = _parseSecret(secret)
-    const key = await crypto.subtle.importKey(parsedSecret.raw ? 'raw' : 'spki', parsedSecret.key, algorithm, false, ['verify'])
-
-    return crypto.subtle.verify(algorithm, key, base64UrlParse(tokenParts[2]), _utf8ToUint8Array(`${tokenParts[0]}.${tokenParts[1]}`))
+    let keyFormat = 'raw'
+    let keyData
+    if (secret.startsWith('-----BEGIN')) {
+        keyFormat = 'spki'
+        keyData = _str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
+    } else
+        keyData = _utf8ToUint8Array(secret)
+    const key = await crypto.subtle.importKey(keyFormat, keyData, algorithm, false, ['verify'])
+    return await crypto.subtle.verify(algorithm, key, base64UrlParse(tokenParts[2]), _utf8ToUint8Array(`${tokenParts[0]}.${tokenParts[1]}`))
 }
 
 /**
  * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
- * 
+ *
  * @param {string} token The token string generated by `jwt.sign()`.
  * @returns {JwtData} Returns an `object` containing `header` and `payload`.
  */