diff --git a/docs/README.md b/docs/README.md index 2054de9b..7229eedf 100644 --- a/docs/README.md +++ b/docs/README.md @@ -192,7 +192,7 @@ Support from the community to continue maintaining and improving this module is - [customFetch](variables/customFetch.md) - [expectNoNonce](variables/expectNoNonce.md) - [expectNoState](variables/expectNoState.md) -- [experimental\_jwksCache](variables/experimental_jwksCache.md) +- [jwksCache](variables/jwksCache.md) - [skipAuthTimeCheck](variables/skipAuthTimeCheck.md) - [skipStateCheck](variables/skipStateCheck.md) - [skipSubjectCheck](variables/skipSubjectCheck.md) diff --git a/docs/interfaces/JWKSCacheOptions.md b/docs/interfaces/JWKSCacheOptions.md index 137eb32b..6f31c3f8 100644 --- a/docs/interfaces/JWKSCacheOptions.md +++ b/docs/interfaces/JWKSCacheOptions.md @@ -8,8 +8,8 @@ Support from the community to continue maintaining and improving this module is ## Properties -### \[experimental\_jwksCache\]? +### \[jwksCache\]? -• `optional` **\[experimental\_jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) +• `optional` **\[jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) -See [experimental_jwksCache](../variables/experimental_jwksCache.md). +See [jwksCache](../variables/jwksCache.md). diff --git a/docs/interfaces/ValidateDetachedSignatureResponseOptions.md b/docs/interfaces/ValidateDetachedSignatureResponseOptions.md index 34ad0aa0..1efdcf35 100644 --- a/docs/interfaces/ValidateDetachedSignatureResponseOptions.md +++ b/docs/interfaces/ValidateDetachedSignatureResponseOptions.md @@ -27,11 +27,11 @@ See [customFetch](../variables/customFetch.md). *** -### \[experimental\_jwksCache\]? +### \[jwksCache\]? -• `optional` **\[experimental\_jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) +• `optional` **\[jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) -See [experimental_jwksCache](../variables/experimental_jwksCache.md). +See [jwksCache](../variables/jwksCache.md). *** diff --git a/docs/interfaces/ValidateJWTAccessTokenOptions.md b/docs/interfaces/ValidateJWTAccessTokenOptions.md index f5576574..57c23340 100644 --- a/docs/interfaces/ValidateJWTAccessTokenOptions.md +++ b/docs/interfaces/ValidateJWTAccessTokenOptions.md @@ -43,11 +43,11 @@ See [customFetch](../variables/customFetch.md). *** -### \[experimental\_jwksCache\]? +### \[jwksCache\]? -• `optional` **\[experimental\_jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) +• `optional` **\[jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) -See [experimental_jwksCache](../variables/experimental_jwksCache.md). +See [jwksCache](../variables/jwksCache.md). *** diff --git a/docs/interfaces/ValidateJwtAuthResponseOptions.md b/docs/interfaces/ValidateJwtAuthResponseOptions.md index 443a5953..abcb2f9d 100644 --- a/docs/interfaces/ValidateJwtAuthResponseOptions.md +++ b/docs/interfaces/ValidateJwtAuthResponseOptions.md @@ -27,11 +27,11 @@ See [customFetch](../variables/customFetch.md). *** -### \[experimental\_jwksCache\]? +### \[jwksCache\]? -• `optional` **\[experimental\_jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) +• `optional` **\[jwksCache\]**: [`JWKSCacheInput`](../type-aliases/JWKSCacheInput.md) -See [experimental_jwksCache](../variables/experimental_jwksCache.md). +See [jwksCache](../variables/jwksCache.md). *** diff --git a/docs/variables/experimental_jwksCache.md b/docs/variables/jwksCache.md similarity index 88% rename from docs/variables/experimental_jwksCache.md rename to docs/variables/jwksCache.md index 077fec51..61d456eb 100644 --- a/docs/variables/experimental_jwksCache.md +++ b/docs/variables/jwksCache.md @@ -1,4 +1,4 @@ -# Variable: experimental\_jwksCache +# Variable: jwksCache [💗 Help the project](https://github.com/sponsors/panva) @@ -6,10 +6,7 @@ Support from the community to continue maintaining and improving this module is *** -• `const` **experimental\_jwksCache**: unique `symbol` - -This is an experimental feature, it is not subject to semantic versioning rules. Non-backward -compatible changes or removal may occur in any future release. +• `const` **jwksCache**: unique `symbol` DANGER ZONE - This option has security implications that must be understood, assessed for applicability, and accepted before use. It is critical that the JSON Web Key Set cache only be @@ -54,7 +51,7 @@ const { uat } = jwksCache // Use JSON Web Key Set cache const accessTokenClaims = await validateJwtAccessToken(as, request, expectedAudience, { - [oauth.experimental_jwksCache]: jwksCache, + [oauth.jwksCache]: jwksCache, }) if (uat !== jwksCache.uat) { diff --git a/src/index.ts b/src/index.ts index 13822fcf..a67985c7 100644 --- a/src/index.ts +++ b/src/index.ts @@ -328,9 +328,6 @@ export const clockTolerance: unique symbol = Symbol() export const customFetch: unique symbol = Symbol() /** - * This is an experimental feature, it is not subject to semantic versioning rules. Non-backward - * compatible changes or removal may occur in any future release. - * * DANGER ZONE - This option has security implications that must be understood, assessed for * applicability, and accepted before use. It is critical that the JSON Web Key Set cache only be * writable by your own code. @@ -374,7 +371,7 @@ export const customFetch: unique symbol = Symbol() * * // Use JSON Web Key Set cache * const accessTokenClaims = await validateJwtAccessToken(as, request, expectedAudience, { - * [oauth.experimental_jwksCache]: jwksCache, + * [oauth.jwksCache]: jwksCache, * }) * * if (uat !== jwksCache.uat) { @@ -383,7 +380,7 @@ export const customFetch: unique symbol = Symbol() * } * ``` */ -export const experimental_jwksCache: unique symbol = Symbol() +export const jwksCache: unique symbol = Symbol() /** * When combined with {@link customFetch} (to use a Fetch API implementation that supports client @@ -1018,9 +1015,9 @@ const SUPPORTED_JWS_ALGS: JWSAlgorithm[] = [ export interface JWKSCacheOptions { /** - * See {@link experimental_jwksCache}. + * See {@link jwksCache}. */ - [experimental_jwksCache]?: JWKSCacheInput + [jwksCache]?: JWKSCacheInput } export interface HttpRequestOptions { @@ -2297,8 +2294,8 @@ async function getPublicSigKeyFromIssuerJwksUri( const { alg, kid } = header checkSupportedJwsAlg(alg) - if (!jwksMap?.has(as) && isFreshJwksCache(options?.[experimental_jwksCache])) { - setJwksCache(as, options?.[experimental_jwksCache].jwks, options?.[experimental_jwksCache].uat) + if (!jwksMap?.has(as) && isFreshJwksCache(options?.[jwksCache])) { + setJwksCache(as, options?.[jwksCache].jwks, options?.[jwksCache].uat) } let jwks: JWKS @@ -2308,13 +2305,13 @@ async function getPublicSigKeyFromIssuerJwksUri( ;({ jwks, age } = jwksMap.get(as)!) if (age >= 300) { // force a re-fetch every 5 minutes - clearJwksCache(as, options?.[experimental_jwksCache]) + clearJwksCache(as, options?.[jwksCache]) return getPublicSigKeyFromIssuerJwksUri(as, options, header) } } else { jwks = await jwksRequest(as, options).then(processJwksResponse) age = 0 - setJwksCache(as, jwks, epochTime(), options?.[experimental_jwksCache]) + setJwksCache(as, jwks, epochTime(), options?.[jwksCache]) } let kty: string @@ -2376,7 +2373,7 @@ async function getPublicSigKeyFromIssuerJwksUri( if (!length) { if (age >= 60) { // allow re-fetch if cache is at least 1 minute old - clearJwksCache(as, options?.[experimental_jwksCache]) + clearJwksCache(as, options?.[jwksCache]) return getPublicSigKeyFromIssuerJwksUri(as, options, header) } throw new OPE('error when selecting a JWT verification key, no applicable keys found') @@ -4736,3 +4733,9 @@ export const experimental_validateDetachedSignatureResponse = ( export const experimental_validateJwtAccessToken = ( ...args: Parameters ) => validateJwtAccessToken(...args) +/** + * @ignore + * + * @deprecated Use {@link jwksCache}. + */ +export const experimental_jwksCache = jwksCache diff --git a/test/jwks_lifecycle_with_cache.test.ts b/test/jwks_lifecycle_with_cache.test.ts index eb7f84cf..9231a9f5 100644 --- a/test/jwks_lifecycle_with_cache.test.ts +++ b/test/jwks_lifecycle_with_cache.test.ts @@ -45,7 +45,7 @@ test.serial('cache is empty at first and set after', async (t) => { let params = new URLSearchParams({ response: jwt }) await lib.validateJwtAuthResponse(as, c, params, undefined, { - [lib.experimental_jwksCache]: cache, + [lib.jwksCache]: cache, }) t.truthy(cache.uat) @@ -75,7 +75,7 @@ test.serial('cache is set and not updated', async (t) => { let params = new URLSearchParams({ response: jwt }) await lib.validateJwtAuthResponse(as, c, params, undefined, { - [lib.experimental_jwksCache]: cache, + [lib.jwksCache]: cache, }) t.deepEqual(before, cache) @@ -114,7 +114,7 @@ test.serial('cache is set and updated', async (t) => { let params = new URLSearchParams({ response: jwt }) await lib.validateJwtAuthResponse(as, c, params, undefined, { - [lib.experimental_jwksCache]: cache, + [lib.jwksCache]: cache, }) t.deepEqual(before.jwks, cache.jwks)