You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -258,6 +260,17 @@ private API and is subject to change between any versions.
258
260
It is **only built for Node.js** environment - it builds on top of the `crypto` module and requires
259
261
the KeyObject API that was added in Node.js v11.6.0 and one-shot sign/verify API added in v12.0.0
260
262
263
+
#### How is it different from [`jws`](https://github.com/brianloveswords/node-jws), [`jwa`](https://github.com/brianloveswords/node-jwa) or [`jsonwebtoken`](https://github.com/auth0/node-jsonwebtoken)?
264
+
265
+
- it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
266
+
- it is providing Key and KeyStore abstractions
267
+
- there is JSON Web Encryption support
268
+
- it supports all JWS / JWE Serialization Syntaxes
269
+
- it supports the "crit" member validations to make sure extensions are handled correctly
270
+
- it is not only validating the signatures, it is making sure the JWE/JWS is syntactically correct,
271
+
e.g. not having duplicated header parameters between protected/unprotected or per-recipient
272
+
headers
273
+
261
274
#### How is it different from [`node-jose`][node-jose]
262
275
263
276
`node-jose` is built to work in any javascript runtime, to be able to do that it packs a lot of
@@ -266,16 +279,6 @@ backfill and javascript implementation code in the form of
266
279
of the module with dependencies that either aren't ever used or have native implementation available
267
280
in Node.js already, those are often times faster and more reliable.
268
281
269
-
#### How is it different from [`node-jws`](https://github.com/brianloveswords/node-jws) or [`node-jwa`](https://github.com/brianloveswords/node-jwa)?
270
-
271
-
- it is not only validating the signatures, it is making sure the JWE/JWS is syntactically correct,
272
-
e.g. not having duplicated header parameters between protected/unprotected or per-recipient
273
-
headers, it does the "crit" member check to make sure extensions are handled correctly
274
-
- it is providing Key and KeyStore abstractions
275
-
- there is JSON Web Encryption support
276
-
- there is no asynchronous API since node crypto is ultimately entirely synchronous
277
-
- it supports all JWS / JWE Serialization Syntaxes
278
-
279
282
#### What is the ultimate goal?
280
283
281
284
-**No dependencies**, the moment JWK formatted keys are supported by node's `crypto` the direct
@@ -284,11 +287,10 @@ dependency count will go down from 1 to 0. 🚀
284
287
285
288
#### Why? Just, why?
286
289
287
-
I was / (still am) using [`node-jose`][node-jose] for
290
+
I was using [`node-jose`][node-jose] for
288
291
[`openid-client`](https://github.com/panva/node-openid-client) and
289
292
[`oidc-provider`](https://github.com/panva/node-oidc-provider) and came to realize its shortcomings
290
-
in terms of performance and API (not having well defined errors). When Node.js v12 lands in April
291
-
2019 I will be releasing new major versions of both those libraries using @panva/jose.
293
+
in terms of performance and API (not having well defined errors).
292
294
293
295
+ this was an amazing opportunity to learn JOSE as a whole
0 commit comments