JSON::JWT is a Ruby library implementing the JSON Web Token (JWT) family of standards, including JWS (JSON Web Signature), JWE (JSON Web Encryption), and JWK (JSON Web Key). It provides comprehensive cryptographic operations for signing, verifying, encrypting, and decrypting tokens using various algorithms (HMAC, RSA, ECDSA, RSA-PSS, and symmetric encryption). The library also includes JWK Set management with remote fetching and caching capabilities. The architecture is modular: JSON::JWT serves as the main entry point, delegating to JSON::JWS for signing/verification and JSON::JWE for encryption/decryption. JSON::JWK handles key representation and conversion between OpenSSL keys and JWK format. The JWK Set Fetcher provides a configurable HTTP client with pluggable caching, suitable for OpenID Connect discovery. The code demonstrates strong security practices, including constant-time comparison for MAC verification, protection against padding oracle attacks in CBC mode, and proper validation of algorithm headers to prevent algorithm confusion attacks. The test suite covers interop with other JWT libraries (Nimbus JOSE, jsrsasign) and RFC examples, ensuring correctness. Key external dependencies include OpenSSL for cryptographic primitives, Faraday for HTTP, and ActiveSupport for hash extensions. The library is actively maintained with support for Ruby 3.2-4.0 and recent security fixes.
This repository is a .NET library for JWT (JSON Web Token) key management that provides automatic generation and rotation of cryptographic keys for JWT signing (JWS) and encryption (JWE). It features a modular architecture with a core library handling key generation/storage, multiple storage providers (in-memory, file system, Entity Framework Core), and framework-specific integrations for ASP.NET Core and IdentityServer4. The library exposes a JWKS endpoint for sharing public keys and integrates with ASP.NET Core authentication systems to validate tokens using the managed keys. Key entry points include the AddJwksManager() service registration method, UseJwksDiscovery() middleware for the JWKS endpoint, and the IJwtService interface for token generation and validation. The primary data flow involves generating cryptographic keys, storing them via pluggable storage providers, retrieving current keys for token operations, and exposing public keys through the JWKS endpoint. The library depends on System.IdentityModel.Tokens.Jwt for JWT handling, Microsoft.AspNetCore.DataProtection for key protection in the default storage implementation, and various Microsoft.Extensions packages for caching, options, and logging.