Jun.Extensions.Jwt 2.5.2

Jun.Extensions.Jwt

Some protocols are customized based on jwt. plaintext jwt, ciphertext jwe. Can be used for token authentication, data encryption and decryption transmission.

Examples

// simple payload
public class Payload
{
    public long UserId { get; set; }
    public string UserName { get; set; }
}

A simple sign/validation example

var secret = "1234567890123456";
var payload = new Payload()
{
    UserId = 123456,
    UserName = "Test",
};
// build
var token = GlobalUtil.Instance.JwtBuilder().SecretUtf8(secret).HeaderTyp().HeaderAlg(JwtSignAlgorithm.HS256).Build(payload);
// eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJVc2VySWQiOjEyMzQ1NiwiVXNlck5hbWUiOiJUZXN0In0.kBoqowtarOH2dpAdLrSRZOOy-Y2hRSc1w-Yh2h6IxRU
Console.WriteLine(token);
// validation
var validationResult = GlobalUtil.Instance.JwtValidation().SecretUtf8(secret).Validate(token, out Payload newPayload);
if (validationResult.ValidationStatus == JwtTokenValidationStatus.Success)
{
    Console.WriteLine(payload.UserId == newPayload.UserId);
}

Standard example (recommend)

// init options.
void InitOption(JwtTokenBuilderMultiple bm, JwtTokenValidationMultiple vm)
{
    // normal jwt
    var builderOption1 = new JwtTokenBuilderMultipleOption()
    {
        Iss = "test",
        Typ = JwtTokenBuilderHeaderTypes.JWT,
        Alg = JwtSignAlgorithm.RS256,
        Secret = "-- sign rsa private key for pkcs#1 or pkcs#8",
        IsAutoIatExp = true,
        Expire = TimeSpan.FromMinutes(30),
    };
    // 3 part jwe, payload is ciphertext
    var builderOption2 = new JwtTokenBuilderMultipleOption()
    {
        Iss = "ciphertext",
        Typ = JwtTokenBuilderHeaderTypes.JWE,
        Alg = JwtSignAlgorithm.RS256,
        Secret = "-- sign rsa private key for pkcs#1 or pkcs#8",
        IsAutoIatExp = true,
        Expire = TimeSpan.FromMinutes(30),
        Enc = JwtEncryptionEncTypes.Aes256EcbPkcs7,
        EncSecret = "123456789A123456", // fixed encrypt symmetric key
    };
    // 4 part jwe, symmetric key is random ciphertext, payload is ciphertext
    var builderOption3 = new JwtTokenBuilderMultipleOption()
    {
        Iss = "random",
        Typ = JwtTokenBuilderHeaderTypes.JWE,
        Alg = JwtSignAlgorithm.RS256,
        Secret = "-- sign rsa private key for pkcs#1 or pkcs#8",
        IsAutoIatExp = true,
        Expire = TimeSpan.FromMinutes(30),
        Enc = JwtEncryptionEncTypes.Aes256EcbPkcs7,
        PublicKey = "-- use the public key encrypt random symmetric key",
    };
    bm.AddOption(builderOption1);
    bm.AddOption(builderOption2);
    bm.AddOption(builderOption3);

    var validationOption1 = new JwtTokenValidationMultipleOption()
    {
        Iss = "test",
        Secret = "-- validation rsa public key", // pair with the same iss
        ValidationFlags = JwtTokenValidationFlags.All, // check iat,exp
    };
    var validationOption2 = new JwtTokenValidationMultipleOption()
    {
        Iss = "ciphertext",
        Secret = "-- validation rsa public key",
        ValidationFlags = JwtTokenValidationFlags.All,
        EncSecret = "123456789A123456", // fixed symmetric key, the same as builder
    };
    var validationOption3 = new JwtTokenValidationMultipleOption()
    {
        Iss = "random",
        Secret = "-- validation rsa public key",
        ValidationFlags = JwtTokenValidationFlags.All,
        PrivateKey = "-- use the private key decrypt random symmetric key",
    };
    vm.AddOption(validationOption1);
    vm.AddOption(validationOption2);
    vm.AddOption(validationOption3);
}

var payload = new Payload()
{
    UserId = 123456,
    UserName = "Test",
};
// create multiple builder/validation
var bm = GlobalUtil.Instance.JwtBuilderMultiple();
var vm = GlobalUtil.Instance.JwtValidationMultiple();
InitOption(bm, vm);
// build from random iss
var iss = bm.RandomIss(new string[] { "test", "ciphertext", "random" });
var token = bm.Build(iss, payload);
Console.WriteLine(token);
// validation
var validationResult = vm.Validate(token, out Payload newPayload);
if (validationResult.ValidationStatus == JwtTokenValidationStatus.Success)
{
    Console.WriteLine(payload.UserId == newPayload.UserId);
}

Protocols

HEADER add iss, pair with build/validation.

• 3 part jwt = jwt.io Encode/Decode
• 3 part jwe (header.ciphertext.signature)

HEADER typ is JWE, enc is AES_256_ECB_PKCS7 AES_192_ECB_PKCS7 AES_128_ECB_PKCS7. can use jwt.io Decode, but payload is ciphertext.

• 4 part jwe (header.enc_secret.ciphertext.signature)

HEADER typ is JWE, enc is AES_256_ECB_PKCS7 AES_192_ECB_PKCS7 AES_128_ECB_PKCS7. can't use jwt.io Decode, 2part(enc secret) 3part(payload) both ciphertext.

Supported Signing/Validation

• ✔ HS256
• ✔ HS384
• ✔ HS512
• ✔ RS256
• ✔ RS384
• ✔ RS512
• ✔ ES256
• ✔ ES384
• ✔ ES512
• ❌ PS256
• ❌ PS384
• ❌ PS512

everything to jwt ^_^

Pairing jun-extensions-jwt.js