Recommended changes from PR. Plus some documentation.

jwt.go

@@ -1,6 +1,7 @@
 package jwt
 
 import (
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/json"
 	"net/http"
@@ -25,7 +26,8 @@ type Claims interface {
 	Valid() error
 }
 
-// Structured version of Claims Section, as referenced at https://tools.ietf.org/html/rfc7519#section-4.1
+// Structured version of Claims Section, as referenced at
+// https://tools.ietf.org/html/rfc7519#section-4.1
 type StandardClaims struct {
 	Audience  string `json:"aud,omitempty"`
 	ExpiresAt int64  `json:"exp,omitempty"`
@@ -36,33 +38,30 @@ type StandardClaims struct {
 	Subject   string `json:"sub,omitempty"`
 }
 
+// Validates time based claims "exp, iat, nbf".
+// There is no accounting for clock skew.
+// As well, if any of the above claims are not in the token, it will still
+// be considered a valid claim.
 func (c StandardClaims) Valid() error {
 	vErr := new(ValidationError)
 	now := TimeFunc().Unix()
 
-	// The claims below are optional, so if they are set to the default value in Go, let's not
+	// The claims below are optional, by default, so if they are set to the
-	// verify them.
+	// default value in Go, let's not fail the verification for them.
-
+	if c.VerifyExpiresAt(now, false) == false {
-	if c.ExpiresAt != 0 {
-		if c.VerifyExpiresAt(now) == false {
 		vErr.err = "Token is expired"
 		vErr.Errors |= ValidationErrorExpired
 	}
-	}
 
-	if c.IssuedAt != 0 {
+	if c.VerifyIssuedAt(now, false) == false {
-		if c.VerifyIssuedAt(now) == false {
 		vErr.err = "Token used before issued, clock skew issue?"
 		vErr.Errors |= ValidationErrorIssuedAt
 	}
-	}
 
-	if c.NotBefore != 0 {
+	if c.VerifyNotBefore(now, false) == false {
-		if c.VerifyNotBefore(now) == false {
 		vErr.err = "Token is not valid yet"
 		vErr.Errors |= ValidationErrorNotValidYet
 	}
-	}
 
 	if vErr.valid() {
 		return nil
@@ -71,103 +70,92 @@ func (c StandardClaims) Valid() error {
 	return vErr
 }
 
-func (c *StandardClaims) VerifyAudience(cmp string) bool {
+// Compares the aud claim against cmp.
-	return verifyAud(c.Audience, cmp)
+// If required is false, this method will return true if the value matches or is unset
+func (c *StandardClaims) VerifyAudience(cmp string, req bool) bool {
+	return verifyAud(c.Audience, cmp, req)
 }
 
-func (c *StandardClaims) VerifyExpiresAt(cmp int64) bool {
+// Compares the exp claim against cmp.
-	return verifyExp(c.ExpiresAt, cmp)
+// If required is false, this method will return true if the value matches or is unset
+func (c *StandardClaims) VerifyExpiresAt(cmp int64, req bool) bool {
+	return verifyExp(c.ExpiresAt, cmp, req)
 }
 
-func (c *StandardClaims) VerifyIssuedAt(cmp int64) bool {
+// Compares the iat claim against cmp.
-	return verifyIat(c.IssuedAt, cmp)
+// If required is false, this method will return true if the value matches or is unset
+func (c *StandardClaims) VerifyIssuedAt(cmp int64, req bool) bool {
+	return verifyIat(c.IssuedAt, cmp, req)
 }
 
-func (c *StandardClaims) VerifyIssuer(cmp string) bool {
+// Compares the iss claim against cmp.
-	return verifyIss(c.Issuer, cmp)
+// If required is false, this method will return true if the value matches or is unset
+func (c *StandardClaims) VerifyIssuer(cmp string, req bool) bool {
+	return verifyIss(c.Issuer, cmp, req)
 }
 
-func (c *StandardClaims) VerifyNotBefore(cmp int64) bool {
+// Compares the nbf claim against cmp.
-	return verifyNbf(c.NotBefore, cmp)
+// If required is false, this method will return true if the value matches or is unset
+func (c *StandardClaims) VerifyNotBefore(cmp int64, req bool) bool {
+	return verifyNbf(c.NotBefore, cmp, req)
 }
 
 type MapClaim map[string]interface{}
 
-func (m MapClaim) VerifyAudience(cmp string) bool {
+// Compares the aud claim against cmp.
-	val, exists := m["aud"]
+// If required is false, this method will return true if the value matches or is unset
-	if !exists {
+func (m MapClaim) VerifyAudience(cmp string, req bool) bool {
-		return true // Don't fail validation if claim doesn't exist
+	aud, _ := m["aud"].(string)
+	return verifyAud(aud, cmp, req)
 }
 
-	if aud, ok := val.(string); ok {
+// Compares the exp claim against cmp.
-		return verifyAud(aud, cmp)
+// If required is false, this method will return true if the value matches or is unset
-	}
+func (m MapClaim) VerifyExpiresAt(cmp int64, req bool) bool {
-	return false
+	exp, _ := m["exp"].(float64)
+	return verifyExp(int64(exp), cmp, req)
 }
 
-func (m MapClaim) VerifyExpiresAt(cmp int64) bool {
+// Compares the iat claim against cmp.
-	val, exists := m["exp"]
+// If required is false, this method will return true if the value matches or is unset
-	if !exists {
+func (m MapClaim) VerifyIssuedAt(cmp int64, req bool) bool {
-		return true
+	iat, _ := m["iat"].(float64)
+	return verifyIat(int64(iat), cmp, req)
 }
 
-	if exp, ok := val.(float64); ok {
+// Compares the iss claim against cmp.
-		return verifyExp(int64(exp), cmp)
+// If required is false, this method will return true if the value matches or is unset
-	}
+func (m MapClaim) VerifyIssuer(cmp string, req bool) bool {
-	return false
+	iss, _ := m["iss"].(string)
+	return verifyIss(iss, cmp, req)
 }
 
-func (m MapClaim) VerifyIssuedAt(cmp int64) bool {
+// Compares the nbf claim against cmp.
-	val, exists := m["iat"]
+// If required is false, this method will return true if the value matches or is unset
-	if !exists {
+func (m MapClaim) VerifyNotBefore(cmp int64, req bool) bool {
-		return true
+	nbf, _ := m["nbf"].(float64)
-	}
+	return verifyNbf(int64(nbf), cmp, req)
-
-	if iat, ok := val.(float64); ok {
-		return verifyIat(int64(iat), cmp)
-	}
-	return false
-}
-
-func (m MapClaim) VerifyIssuer(cmp string) bool {
-	val, exists := m["iss"]
-	if !exists {
-		return true
-	}
-
-	if iss, ok := val.(string); ok {
-		return verifyIss(iss, cmp)
-	}
-	return false
-}
-
-func (m MapClaim) VerifyNotBefore(cmp int64) bool {
-	val, exists := m["nbf"]
-	if !exists {
-		return true
-	}
-
-	if nbf, ok := val.(float64); ok {
-		return verifyNbf(int64(nbf), cmp)
-	}
-	return false
 }
 
+// Validates time based claims "exp, iat, nbf".
+// There is no accounting for clock skew.
+// As well, if any of the above claims are not in the token, it will still
+// be considered a valid claim.
 func (m MapClaim) Valid() error {
 	vErr := new(ValidationError)
 	now := TimeFunc().Unix()
 
-	if m.VerifyExpiresAt(now) == false {
+	if m.VerifyExpiresAt(now, false) == false {
 		vErr.err = "Token is expired"
 		vErr.Errors |= ValidationErrorExpired
 	}
 
-	if m.VerifyIssuedAt(now) == false {
+	if m.VerifyIssuedAt(now, false) == false {
 		vErr.err = "Token used before issued, clock skew issue?"
 		vErr.Errors |= ValidationErrorIssuedAt
 	}
 
-	if m.VerifyNotBefore(now) == false {
+	if m.VerifyNotBefore(now, false) == false {
 		vErr.err = "Token is not valid yet"
 		vErr.Errors |= ValidationErrorNotValidYet
 	}
@@ -179,23 +167,46 @@ func (m MapClaim) Valid() error {
 	return vErr
 }
 
-func verifyAud(aud string, cmp string) bool {
+func verifyAud(aud string, cmp string, required bool) bool {
-	return aud == cmp
+	if aud == "" {
+		return !required
+	}
+	if subtle.ConstantTimeCompare([]byte(aud), []byte(cmp)) != 0 {
+		return true
+	} else {
+		return false
+	}
 }
 
-func verifyExp(exp int64, now int64) bool {
+func verifyExp(exp int64, now int64, required bool) bool {
+	if exp == 0 {
+		return !required
+	}
 	return now <= exp
 }
 
-func verifyIat(iat int64, now int64) bool {
+func verifyIat(iat int64, now int64, required bool) bool {
+	if iat == 0 {
+		return !required
+	}
 	return now >= iat
 }
 
-func verifyIss(iss string, cmp string) bool {
+func verifyIss(iss string, cmp string, required bool) bool {
-	return iss == cmp
+	if iss == "" {
+		return !required
+	}
+	if subtle.ConstantTimeCompare([]byte(iss), []byte(cmp)) != 0 {
+		return true
+	} else {
+		return false
+	}
 }
 
-func verifyNbf(nbf int64, now int64) bool {
+func verifyNbf(nbf int64, now int64, required bool) bool {
+	if nbf == 0 {
+		return !required
+	}
 	return now >= nbf
 }