npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

jose-skip-key-validation

v3.19.0

Published

Universal 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies

Downloads

10

Readme

jose

Universal "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK with no dependencies using native crypto runtimes

Implemented specs & features

The following specifications are implemented by jose

The test suite utilizes examples defined in RFC7520 to confirm its JOSE implementation is correct.

Support

If you or your business use jose, please consider becoming a sponsor so I can continue maintaining it and adding new features carefree.

Documentation

Supported Runtimes, Environments, Platforms

FAQ

Supported Versions

| Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ | | ------- | --------- | -------- | -------- | | 3.x.x | ✅ | ✅ | ✅ | | 2.x.x | ✅ | ✅ until 2022-04-30 | ❌ | | 1.x.x | ✅ | ❌ | ❌ |

What is new in v3.x?

  • Revised API
  • No dependencies
  • Browser, Cloudflare Workers, and Deno support (using Web Cryptography API)
  • Promise-based API

v2.x docs?

Here.

Semver?

Yes. All module's public API is subject to Semantic Versioning 2.0.0.

How is it different from jws, jwa or jsonwebtoken?

  • it supports the browser, Cloudflare Workers, and Deno runtimes
  • it supports encrypted JWTs (i.e. in JWE format)
  • supports secp256k1, Ed25519, Ed448, X25519, and X448
  • it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
  • it is exclusively using native platform Key object representations (CryptoKey and KeyObject)
  • there is JSON Web Encryption support
  • it supports the flattened JWS / JWE Serialization Syntaxes
  • it supports the "crit" member validations to make sure extensions are handled correctly

How is it different from node-jose?

node-jose is built to work in any javascript runtime, to be able to do that it packs a lot of polyfills and javascript implementation code in the form of node-forge, this significantly increases the footprint of the modules with dependencies that either aren't ever used or have native implementation available in the runtime already, those are often times faster and more reliable.

  • it has smaller module footprint as it does not bundle unnecessary polyfills
  • it does not bundle node-forge fallbacks when crypto runtime is unavailable
  • supports secp256k1, Ed25519, Ed448, X25519, and X448

Uint8Array?!

  • Whenever Uint8Array is a valid input, so is Buffer since buffers are instances of Uint8Array.
  • Whenever Uint8Array is returned and you want a Buffer instead, use Buffer.from(uint8array).

Bundle Size, Package Size, Tree Shaking

Yes the bundle size is on the larger side, that is because each module is actually published multiple times so that it can remain truly without dependencies and be universal / isomorphic.

Nevertheless, since each module can be required independently and is fully tree-shakeable, the install size should not be a cause for concern.