Skip to content

Conversation

@paweldomas
Copy link

Adds basic support for RS256 signature verification.
The 'key' should be passed as a string which contains public key in PEM format for example:

-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcN....................7ogs8j2XThEFa1iPooa
RPE/2+a8z9N1+8d9a....................Ncijm15Z7y/psCAwEAAQ==
-----END PUBLIC KEY-----

It would be great to have a new release available as lua rock if this PR gets merged eventually, thanks !

@EyMaddis
Copy link

EyMaddis commented Jan 4, 2017

I am not sure of the inner workings of
local pubkey = crypto.pkey.from_pem(key), but this might be leading to the the latest security vulnerability:
https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Right now this is not the case as only HMAC based certificates are allowed, but once public keys are used, this has to be considered.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants