decode() without verification
The decode function allows inspection of the header and payload of a JWT token without performing signature verification. This can be useful for debugging or extracting information from JWT tokens.
helpers/jwt
14 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
JWT helper import
The JWT helper functions are imported from 'hono/jwt'. Available functions are decode, sign, and verify. The jwt function used by JWT Middleware also comes from 'hono/jwt'.
sign() function signature
sign(payload: unknown, secret: string, alg?: 'HS256'): Promise<string>. Creates a JWT token by encoding a payload and signing it with the specified algorithm and secret. Returns a Promise that resolves to the signed token string.
sign() parameters
payload (required, unknown): The JWT payload to be signed, can include other claims. secret (required, string): The secret key used for JWT signing. alg (optional, AlgorithmTypes): The algorithm used for JWT signing, default is HS256.
sign() example
import { sign } from 'hono/jwt' const payload = { sub: 'user123', role: 'admin', exp: Math.floor(Date.now() / 1000) + 60 * 5, // Token expires in 5 minutes } const secret = 'mySecretKey' const token = await sign(payload, secret)
verify() function signature
verify(token: string, secret: string, alg: 'HS256', issuer?: string | RegExp, aud?: string | string[] | RegExp): Promise<any>. Verifies a JWT token is genuine and valid, checking that it hasn't been altered and validating claims if included.
verify() parameters
token (required, string): The JWT token to be verified. secret (required, string): The secret key used for JWT verification. alg (required, AlgorithmTypes): The algorithm used for JWT verification. issuer (optional, string | RegExp): The expected issuer used for JWT verification. aud (optional, string | string[] | RegExp): The expected audience used for JWT verification. If set, the token must include an aud claim and at least one audience value must match.
verify() example
import { verify } from 'hono/jwt' const tokenToVerify = 'token' const secretKey = 'mySecretKey' const decodedPayload = await verify(tokenToVerify, secretKey, 'HS256') console.log(decodedPayload)
decode() function signature
decode(token: string): { header: any; payload: any }. Decodes a JWT token without performing signature verification, extracting and returning the header and payload from the token.
decode() parameters
token (required, string): The JWT token to be decoded.
decode() example
import { decode } from 'hono/jwt' const tokenToDecode = 'eyJ••••••LA' const { header, payload } = decode(tokenToDecode) console.log('Decoded Header:', header) console.log('Decoded Payload:', payload)
JWT payload validation checks
When verifying a JWT token, the following payload validations are performed: exp (checks token has not expired), nbf (checks token is not being used before specified time), iat (checks token is not issued in the future), iss (checks token is issued by trusted issuer), aud (checks token is intended for accepted audience when aud verification parameter is set). Ensure JWT payload includes these fields if performing these checks during verification.
JWT custom error types
JwtAlgorithmNotImplemented: requested JWT algorithm not implemented. JwtTokenInvalid: JWT token is invalid. JwtTokenNotBefore: token used before valid date. JwtTokenExpired: token has expired. JwtTokenIssuedAt: iat claim incorrect. JwtTokenIssuer: iss claim incorrect. JwtPayloadRequiresAud: aud claim required when aud verification configured. JwtTokenAudience: token's aud claim does not match expected audience. JwtTokenSignatureMismatched: signature mismatch in token.
Supported JWT algorithms
HS256: HMAC using SHA-256. HS384: HMAC using SHA-384. HS512: HMAC using SHA-512. RS256: RSASSA-PKCS1-v1_5 using SHA-256. RS384: RSASSA-PKCS1-v1_5 using SHA-384. RS512: RSASSA-PKCS1-v1_5 using SHA-512. PS256: RSASSA-PSS using SHA-256 and MGF1 with SHA-256. PS384: RSASSA-PSS using SHA-386 and MGF1 with SHA-386. PS512: RSASSA-PSS using SHA-512 and MGF1 with SHA-512. ES256: ECDSA using P-256 and SHA-256. ES384: ECDSA using P-384 and SHA-384. ES512: ECDSA using P-521 and SHA-512. EdDSA: EdDSA using Ed25519.