2.2.5

.editorconfig

@@ -0,0 +1,10 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = false
+
+[src/**/*.ts]
+charset = utf-8
+indent_style = space
+indent_size = 4

.npmignore

@@ -3,4 +3,5 @@ src/
 test/
 .nvmrc
 index.test.js
-tsconfig.json
+tsconfig.json
+.editorconfig

.nvmrc

@@ -1 +0,0 @@
-v16

README.md

@@ -104,7 +104,7 @@ Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 `secret`    | `string` | required | -       | The string which was used to sign the payload.
-`options`   | `object` | optional | `{ algorithm: 'HS256', throwError: false }` | The options object supporting `algorithm` and `throwError`. (See [Available Algorithms](#available-algorithms))
+`options`   | `object` | optional | `{ algorithm: 'HS256', skipValidation: false, throwError: false }` | The options object supporting `algorithm`, `skipValidation` and `throwError`. (See [Available Algorithms](#available-algorithms))
 
 #### `throws`
 If `options.throwError` is `true` and the token is invalid, an error will be thrown.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.2.0",
+  "version": "2.2.5",
   "description": "A lightweight JWT implementation with ZERO dependencies for Cloudflare Worker",
   "main": "index.js",
   "types": "index.d.ts",
@@ -26,8 +26,8 @@
   },
   "homepage": "https://github.com/tsndr/cloudflare-worker-jwt#readme",
   "devDependencies": {
-    "@cloudflare/workers-types": "^3.13.0",
+    "@cloudflare/workers-types": "^4.20231002.0",
-    "jest": "^28.1.1",
+    "jest": "^29.7.0",
-    "typescript": "^4.7.4"
+    "typescript": "^5.2.2"
   }
 }

src/index.ts

@@ -33,7 +33,7 @@ export interface JwtHeader {
  * @typedef JwtPayload
  * @prop {string} [iss] Issuer
  * @prop {string} [sub] Subject
- * @prop {string} [aud] Audience
+ * @prop {string | string[]} [aud] Audience
  * @prop {string} [exp] Expiration Time
  * @prop {string} [nbf] Not Before
  * @prop {string} [iat] Issued At
@@ -47,7 +47,7 @@ export interface JwtPayload {
     sub?: string
 
     /** Audience */
-    aud?: string
+    aud?: string | string[]
 
     /** Expiration Time */
     exp?: number
@@ -87,6 +87,11 @@ export interface JwtSignOptions extends JwtOptions {
  * @prop {boolean} [throwError=false] If `true` throw error if checks fail. (default: `false`)
  */
 export interface JwtVerifyOptions extends JwtOptions {
+    /**
+     * If `true` all expiry checks will be skipped
+    */
+    skipValidation?: boolean
+
     /**
      * If `true` throw error if checks fail. (default: `false`)
      *
@@ -229,11 +234,11 @@ export async function sign(payload: JwtPayload, secret: string | JsonWebKey, opt
  * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
  * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`.
  */
-export async function verify(token: string, secret: string | JsonWebKey, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', throwError: false }): Promise<boolean> {
+export async function verify(token: string, secret: string | JsonWebKey, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', skipValidation: false, throwError: false }): Promise<boolean> {
     if (typeof options === 'string')
         options = { algorithm: options, throwError: false }
 
-    options = { algorithm: 'HS256', throwError: false, ...options }
+    options = { algorithm: 'HS256', skipValidation: false, throwError: false, ...options }
 
     if (typeof token !== 'string')
         throw new Error('token must be a string')
@@ -256,21 +261,21 @@ export async function verify(token: string, secret: string | JsonWebKey, options
 
     const { payload } = decode(token)
 
-    if (!payload) {
+    if (!options.skipValidation && !payload) {
         if (options.throwError)
             throw 'PARSE_ERROR'
 
         return false
     }
 
-    if (payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
+    if (!options.skipValidation && payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
         if (options.throwError)
             throw 'NOT_YET_VALID'
 
         return false
     }
 
-    if (payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
+    if (!options.skipValidation && payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
         if (options.throwError)
             throw 'EXPIRED'
 
@@ -283,7 +288,7 @@ export async function verify(token: string, secret: string | JsonWebKey, options
         keyFormat = 'jwk';
         keyData = secret;
     } else if (typeof secret === 'string' && secret.startsWith('-----BEGIN')) {
-        keyFormat = 'pkcs8'
+        keyFormat = 'spki'
         keyData = _str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
     } else
         keyData = _utf8ToUint8Array(secret)