feat: introduce getClaims method to verify asymmetric JWTs #1030

kangmingtay · 2025-01-29T01:45:43Z

What kind of change does this PR introduce?

getClaims supports verifying JWTs (both asymmetric and symmetric) and returns the entire set of claims in the JWT payload

src/lib/rfc4648.ts

src/lib/helpers.ts

hf · 2025-01-29T09:38:38Z

src/GoTrueClient.ts

+    // try fetching from cache
+    jwk = this.jwks.keys.find((key) => key.kid === kid)
+    if (jwk) {
+      return jwk
+    }


It's important to have a process to clear-out entries from the cache according to the cache headers sent in the response. If this is used in a long-running Node server, and the JWT keys get rotated, the new keys will never be fetched.

it will because when a new JWT needs to be validated, there will be a cache miss, which would trigger getClaims to fetch the latest JWKS

src/GoTrueClient.ts

hf · 2025-01-29T09:45:39Z

src/GoTrueClient.ts

+        data: {
+          claims: payload,
+        },


Either return payload as data or include more information, such as:

Suggested change

data: {

claims: payload,

},

data: {

claims: payload,

header,

signature,

},

hmm why? the intention behind nesting it in claims is to be consistent with the response structure for getUser and getSession

src/GoTrueClient.ts

kangmingtay added 5 commits January 28, 2025 16:50

feat: add getClaims method

48ecbc9

chore(refactor): unify jwt decoding

317184f

fix: cache jwks in memory

e53fde0

chore: add experimental tag

bf7c13d

fix: save jwks in memory

be6a07a