{"id":13402578,"url":"https://github.com/cisco/node-jose","last_synced_at":"2025-05-14T09:07:23.703Z","repository":{"id":37663801,"uuid":"42272491","full_name":"cisco/node-jose","owner":"cisco","description":null,"archived":false,"fork":false,"pushed_at":"2024-01-18T20:14:22.000Z","size":1528,"stargazers_count":692,"open_issues_count":59,"forks_count":120,"subscribers_count":19,"default_branch":"master","last_synced_at":"2024-05-23T10:01:16.527Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cisco.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-09-10T21:49:24.000Z","updated_at":"2024-06-18T11:17:12.752Z","dependencies_parsed_at":"2024-01-08T07:57:22.575Z","dependency_job_id":"2918b779-0c20-4d19-8e79-b528dd5d9830","html_url":"https://github.com/cisco/node-jose","commit_stats":{"total_commits":235,"total_committers":37,"mean_commits":6.351351351351352,"dds":0.5872340425531914,"last_synced_commit":"37db9e5371dc9a0557767a6a0190e2b0ab5cf3b6"},"previous_names":[],"tags_count":31,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisco%2Fnode-jose","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisco%2Fnode-jose/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisco%2Fnode-jose/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisco%2Fnode-jose/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cisco","download_url":"https://codeload.github.com/cisco/node-jose/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248688519,"owners_count":21145763,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T19:01:17.901Z","updated_at":"2025-04-13T08:51:02.184Z","avatar_url":"https://github.com/cisco.png","language":"JavaScript","funding_links":[],"categories":["JavaScript","🔐 Authentication \u0026 Authorization"],"sub_categories":["Query Builders"],"readme":"# node-jose #\n\n[![Greenkeeper badge](https://badges.greenkeeper.io/cisco/node-jose.svg)](https://greenkeeper.io/)\n[![Build Status](https://travis-ci.org/cisco/node-jose.svg?branch=master)](https://travis-ci.org/cisco/node-jose)\n\nA JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers.  This library implements (wherever possible) all algorithms, formats, and options in [JWS](https://tools.ietf.org/html/rfc7515 \"Jones, M., J. Bradley and N. Sakimura, 'JSON Web Signature (JWS)' RFC 7515, May 2015\"), [JWE](https://tools.ietf.org/html/rfc7516 \"Jones, M. and J. Hildebrand 'JSON Web Encryption (JWE)', RFC 7516, May 2015\"), [JWK](https://tools.ietf.org/html/rfc7517 \"Jones, M., 'JSON Web Key (JWK)', RFC 7517, May 2015\"), and [JWA](https://tools.ietf.org/html/rfc7518 \"Jones, M., 'JSON Web Algorithms (JWA)', RFC 7518, May 2015\") and uses native cryptographic support ([WebCrypto API](http://www.w3.org/TR/WebCryptoAPI/) or node.js' \"[crypto](https://nodejs.org/api/crypto.html)\" module) where feasible.\n\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n\n- [Installing](#installing)\n- [Basics](#basics)\n- [Keys and Key Stores](#keys-and-key-stores)\n  - [Obtaining a KeyStore](#obtaining-a-keystore)\n  - [Exporting a KeyStore](#exporting-a-keystore)\n  - [Retrieving Keys](#retrieving-keys)\n  - [Searching for Keys](#searching-for-keys)\n  - [Managing Keys](#managing-keys)\n  - [Importing and Exporting a Single Key](#importing-and-exporting-a-single-key)\n  - [Obtaining a Key's Thumbprint](#obtaining-a-keys-thumbprint)\n- [Signatures](#signatures)\n  - [Keys Used for Signing and Verifying](#keys-used-for-signing-and-verifying)\n  - [Signing Content](#signing-content)\n  - [Verifying a JWS](#verifying-a-jws)\n    - [Allowing (or Disallowing) Signature Algorithms](#allowing-or-disallowing-signature-algorithms)\n    - [Handling `crit` Header Members](#handling-crit-header-members)\n- [Encryption](#encryption)\n  - [Keys Used for Encrypting and Decrypting](#keys-used-for-encrypting-and-decrypting)\n  - [Encrypting Content](#encrypting-content)\n  - [Decrypting a JWE](#decrypting-a-jwe)\n    - [Allowing (or Disallowing) Encryption Algorithms](#allowing-or-disallowing-encryption-algorithms)\n    - [Handling `crit` Header Members](#handling-crit-header-members-1)\n- [Useful Utilities](#useful-utilities)\n  - [Converting to Buffer](#converting-to-buffer)\n  - [URI-Safe Base64](#uri-safe-base64)\n  - [Random Bytes](#random-bytes)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\n## Installing ##\n\nTo install the latest from [NPM](https://npmjs.com/):\n\n```shell\n  npm install node-jose\n```\n\nOr to install a specific release:\n\n```shell\n  npm install node-jose@0.3.0\n```\n\nAlternatively, the latest unpublished code can be installed directly from the repository:\n\n```shell\n  npm install git+https://github.com/cisco/node-jose.git\n```\n\n## Basics ##\n\nRequire the library as normal:\n\n```javascript\nvar jose = require('node-jose');\n```\n\nThis library uses [Promises](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) for nearly every operation.\n\nThis library supports [Browserify](http://browserify.org/) and [Webpack](https://webpack.github.io/).  To use in a web browser, `require('node-jose')` and bundle with the rest of your app.\n\nThe content to be signed/encrypted -- or returned from being verified/decrypted -- are [Buffer](https://nodejs.org/api/buffer.html) objects.\n\n## Keys and Key Stores ##\n\nThe `jose.JWK` namespace deals with JWK and JWK-sets.\n\n* `jose.JWK.Key` is a logical representation of a JWK, and is the \"raw\" entry point for various cryptographic operations (e.g., sign, verify, encrypt, decrypt).\n* `jose.JWK.KeyStore` represents a collection of Keys.\n\nCreating a JWE or JWS ultimately require one or more explicit Key objects.\n\nProcessing a JWE or JWS relies on a KeyStore.\n\n### Obtaining a KeyStore ###\nTo create an empty keystore:\n\n```javascript\nkeystore = jose.JWK.createKeyStore();\n```\n\nTo import a JWK-set as a keystore:\n\n```javascript\n// {input} is a String or JSON object representing the JWK-set\njose.JWK.asKeyStore(input).\n     then(function(result) {\n       // {result} is a jose.JWK.KeyStore\n       keystore = result;\n     });\n```\n\n### Exporting a KeyStore ###\n\nTo export the public keys of a keystore as a JWK-set:\n\n```javascript\noutput = keystore.toJSON();\n```\n\nTo export **all** the keys of a keystore:\n\n```javascript\noutput = keystore.toJSON(true);\n```\n\n### Retrieving Keys ###\n\nTo retrieve a key from a keystore:\n\n```javascript\n// by 'kid'\nkey = keystore.get(kid);\n```\n\nThis retrieves the first key that matches the given {kid}.  If multiple keys have the same {kid}, you can further narrow what to retrieve:\n\n```javascript\n// ... and by 'kty'\nkey = keystore.get(kid, { kty: 'RSA' });\n\n// ... and by 'use'\nkey = keystore.get(kid, { use: 'enc' });\n\n// ... and by 'alg'\nkey = keystore.get(kid, { use: 'RSA-OAEP' });\n\n// ... and by 'kty' and 'use'\nkey = keystore.get(kid, { kty: 'RSA', use: 'enc' });\n\n// same as above, but with a single {props} argument\nkey = keystore.get({ kid: kid, kty: 'RSA', use: 'enc' });\n```\n\n### Searching for Keys ###\n\nTo retrieve all the keys from a keystore:\n\n```javascript\neverything = keystore.all();\n```\n\n`all()` can be filtered much like `get()`:\n\n```javascript\n// filter by 'kid'\neverything = keystore.all({ kid: kid });\n\n// filter by 'kty'\neverything = keystore.all({ kty: 'RSA' });\n\n// filter by 'use'\neverything = keystore.all({ use: 'enc' });\n\n// filter by 'alg'\neverything = keystore.all({ alg: 'RSA-OAEP' });\n\n// filter by 'kid' + 'kty' + 'alg'\neverything = keystore.all({ kid: kid, kty: 'RSA', alg: 'RSA-OAEP' });\n```\n\n### Managing Keys ###\n\nTo import an existing Key (as a JSON object or Key instance):\n\n```javascript\n// input is either a:\n// *  jose.JWK.Key to copy from; or\n// *  JSON object representing a JWK; or\nkeystore.add(input).\n        then(function(result) {\n          // {result} is a jose.JWK.Key\n          key = result;\n        });\n```\n\nTo import and existing Key from a PEM or DER:\n\n```javascript\n// input is either a:\n// *  String serialization of a JSON JWK/(base64-encoded) PEM/(binary-encoded) DER\n// *  Buffer of a JSON JWK/(base64-encoded) PEM/(binary-encoded) DER\n// form is either a:\n// * \"json\" for a JSON stringified JWK\n// * \"private\" for a DER encoded 'raw' private key\n// * \"pkcs8\" for a DER encoded (unencrypted!) PKCS8 private key\n// * \"public\" for a DER encoded SPKI public key (alternate to 'spki')\n// * \"spki\" for a DER encoded SPKI public key\n// * \"pkix\" for a DER encoded PKIX X.509 certificate\n// * \"x509\" for a DER encoded PKIX X.509 certificate\n// * \"pem\" for a PEM encoded of PKCS8 / SPKI / PKIX\nkeystore.add(input, form).\n        then(function(result) {\n          // {result} is a jose.JWK.Key\n        });\n```\n\nTo generate a new Key:\n\n```javascript\n// first argument is the key type (kty)\n// second is the key size (in bits) or named curve ('crv') for \"EC\"\nkeystore.generate(\"oct\", 256).\n        then(function(result) {\n          // {result} is a jose.JWK.Key\n          key = result;\n        });\n\n// ... with properties\nvar props = {\n  kid: 'gBdaS-G8RLax2qgObTD94w',\n  alg: 'A256GCM',\n  use: 'enc'\n};\nkeystore.generate(\"oct\", 256, props).\n        then(function(result) {\n          // {result} is a jose.JWK.Key\n          key = result;\n        });\n```\n\nTo remove a Key from its Keystore:\n```javascript\nkeystore.remove(key);\n// NOTE: key.keystore does not change!!\n```\n\n### Importing and Exporting a Single Key ###\n\nTo create a single \"stand alone\" key:\n\n```javascript\njose.JWK.createKey(\"oct\", 256, { alg: \"A256GCM\" }).\n         then(function(result) {\n           // {result} is a jose.JWK.Key\n           // {result.keystore} is a unique jose.JWK.KeyStore\n         });\n```\n\n\nTo import a single Key:\n\n```javascript\n// where input is either a:\n// *  jose.JWK.Key instance\n// *  JSON Object representation of a JWK\njose.JWK.asKey(input).\n        then(function(result) {\n          // {result} is a jose.JWK.Key\n          // {result.keystore} is a unique jose.JWK.KeyStore\n        });\n\n// where input is either a:\n// *  String serialization of a JSON JWK/(base64-encoded) PEM/(binary-encoded) DER\n// *  Buffer of a JSON JWK/(base64-encoded) PEM/(binary-encoded) DER\n// form is either a:\n// * \"json\" for a JSON stringified JWK\n// * \"pkcs8\" for a DER encoded (unencrypted!) PKCS8 private key\n// * \"spki\" for a DER encoded SPKI public key\n// * \"pkix\" for a DER encoded PKIX X.509 certificate\n// * \"x509\" for a DER encoded PKIX X.509 certificate\n// * \"pem\" for a PEM encoded of PKCS8 / SPKI / PKIX\njose.JWK.asKey(input, form).\n        then(function(result) {\n          // {result} is a jose.JWK.Key\n          // {result.keystore} is a unique jose.JWK.KeyStore\n        });\n```\n\nTo export the public portion of a Key as a JWK:\n\n```javascript\nvar output = key.toJSON();\n```\n\nTo export the public **and** private portions of a Key:\n\n```javascript\nvar output = key.toJSON(true);\n```\n\n### Obtaining a Key's Thumbprint ###\n\nTo get or calculate a [RFC 7638](https://tools.ietf.org/html/rfc7638) thumbprint for a key:\n\n```javascript\n// where hash is a supported algorithm, currently one of:\n// * SHA-1\n// * SHA-256\n// * SHA-384\n// * SHA-512\nkey.thumbprint(hash).\n    then(function(print) {\n      // {print} is a Buffer containing the thumbprint binary value\n    });\n```\n\nWhen importing or generating a key that does not have a \"kid\" defined, a\n\"SHA-256\" thumbprint is calculated and used as the \"kid\".\n\n## Signatures ##\n\n### Keys Used for Signing and Verifying ###\n\nWhen signing content, the key is expected to meet one of the following:\n\n1. A secret key (e.g, `\"kty\":\"oct\"`)\n2. The **private** key from a PKI (`\"kty\":\"EC\"` or `\"kty\":\"RSA\"`) key pair\n\nWhen verifying content, the key is expected to meet one of the following:\n\n1. A secret key (e.g, `\"kty\":\"oct\"`)\n2. The **public** key from a PKI (`\"kty\":\"EC\"` or `\"kty\":\"RSA\"`) key pair\n\n\n### Signing Content ###\n\nAt its simplest, to create a JWS:\n\n```javascript\n// {input} is a Buffer\njose.JWS.createSign(key).\n        update(input).\n        final().\n        then(function(result) {\n          // {result} is a JSON object -- JWS using the JSON General Serialization\n        });\n```\n\nThe JWS is signed using the preferred algorithm appropriate for the given Key.  The preferred algorithm is the first item returned by `key.algorithms(\"sign\")`.\n\nTo create a JWS using another serialization format:\n\n```javascript\njose.JWS.createSign({ format: 'flattened' }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // {result} is a JSON object -- JWS using the JSON Flattened Serialization\n        });\n\njose.JWS.createSign({ format: 'compact' }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // {result} is a String -- JWS using the Compact Serialization\n        });\n```\n\nTo create a JWS using a specific algorithm:\n```javascript\njose.JWS.createSign({ fields: { alg: 'PS256' } }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\nTo create a JWS for a specified content type:\n\n```javascript\njose.JWS.createSign({ fields: { cty: 'jwk+json' } }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\nTo create a JWS from String content:\n\n```javascript\njose.JWS.createSign(key).\n        update(input, \"utf8\").\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\nTo create a JWS with multiple signatures:\n\n```javascript\n// {keys} is an Array of jose.JWK.Key instances\njose.JWS.createSign(keys).\n        update(input).\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\n### Verifying a JWS ###\n\nTo verify a JWS, and retrieve the payload:\n\n```javascript\njose.JWS.createVerify(keystore).\n        verify(input).\n        then(function(result) {\n          // {result} is a Object with:\n          // *  header: the combined 'protected' and 'unprotected' header members\n          // *  payload: Buffer of the signed content\n          // *  signature: Buffer of the verified signature\n          // *  key: The key used to verify the signature\n        });\n```\n\nTo verify using an implied Key:\n\n```javascript\n// {key} can be:\n// *  jose.JWK.Key\n// *  JSON object representing a JWK\njose.JWS.createVerify(key).\n        verify(input).\n        then(function(result) {\n          // ...\n        });\n```\n\nTo verify using a key embedded in the JWS:\n\n```javascript\njose.JWS.createVerify().\n        verify(input, { allowEmbeddedKey: true }).\n        then(function(result) {\n          // ...\n        });\n```\n\nAlternatively, a cached `createVerify()` can be configured to allow an embedded key:\n\n```javascript\nvar verifier = jose.JWS.createVerify({ allowEmbeddedKey: true });\n\nverifier.verify(input).\n         then(function(result) {\n           // ...\n         });\n```\n\nThe key can be embedded using either 'jwk' or 'x5c', and can be located in either the JWS Unprotected Header or JWS Protected Header.\n\n**NOTE:** `verify()` will use the embedded key (if found and permitted) instead of any other key.\n\n#### Allowing (or Disallowing) Signature Algorithms ###\n\nTo restrict what signature algorithms are allowed when verifying, add the `algorithms` member to the `options` Object.  The `algorithms` member is either a string or an array of strings, where the string value(s) can be one of the following:\n\n* `\"*\"`: accept all supported algorithms\n* **`\u003calg name\u003e`** (e.g., `\"PS256\"`): accept the specific algorithm (can have a single '*' to match a range of algorithms)\n* **`!\u003calg name\u003e`** (e.g., `\"!RS256\"`): *do not* accept the specific algorithm (can have a single '*' to match a range of algorithms)\n\nThe negation is intended to be used with the wildcard accept string, and disallow takes precedence over allowed.\n\nTo only accept RSA-PSS sigatures:\n\n```javascript\nvar opts = {\n  algorithms: [\"PS*\"]\n};\njose.JWS.createVerify(key, opts).\n        verify(input).\n        then(function(result) {\n          // ...\n        });\n```\n\nTo accept any algorithm, but disallow HMAC-based signatures:\n\n```javascript\nvar opts = {\n  algorithms: [\"*\", \"!HS*\"]\n};\njose.JWS.createVerify(key, opts).\n        verify(input).\n        then(function(result) {\n          // ...\n        });\n```\n\n#### Handling `crit` Header Members ####\n\nTo accept 'crit' field members, add the `handlers` member to the options Object.  The `handlers` member is itself an Object, where its member names are the `crit` header member, and the value is one of:\n\n* `Function`: takes the JWE decrypt output (just prior to decrypting) and returns a Promise for the processing of the member.\n* `Object`: An object with the following `Function` members:\n  * \"prepare\" -- takes the JWE decrypt output (just prior to decrypting) and returns a Promise for the processing of the member.\n  * \"complete\" -- takes the JWE decrypt output (immediately after decrypting) and returns a Promise for the processing of the member.\n\n**NOTE** If the handler function returns a promise, the fulfilled value is ignored.  It is expected these handler functions will modify the provided value directly.\n\nTo perform additional (pre-verify) processing on a `crit` header member:\n\n```javascript\nvar opts = {\n  handlers: {\n    \"exp\": function(jws) {\n      // {jws} is the JWS verify output, pre-verification\n      jws.header.exp = new Date(jws.header.exp);\n    }\n  }\n};\njose.JWS.createVerify(key, opts).\n        verify(input).\n        then(function(result) {\n          // ...\n        });\n```\n\nTo perform additional (post-verify) processing on a `crit` header member:\n\n```javascript\nvar opts = {\n  handlers: {\n    \"exp\": {\n      complete: function(jws) {\n        // {jws} is the JWS verify output, post-verification\n        jws.header.exp = new Date(jws.header.exp);\n      }\n    }\n  }\n};\njose.JWS.createVerify(key, opts).\n        verify(input).\n        then(function(result) {\n          // ...\n        });\n```\n\n\n## Encryption ##\n\n\n### Keys Used for Encrypting and Decrypting ###\n\nWhen encrypting content, the key is expected to meet one of the following:\n\n1. A secret key (e.g, `\"kty\":\"oct\"`)\n2. The **public** key from a PKI (`\"kty\":\"EC\"` or `\"kty\":\"RSA\"`) key pair\n\nWhen decrypting content, the key is expected to meet one of the following:\n\n1. A secret key (e.g, `\"kty\":\"oct\"`)\n2. The **private** key from a PKI (`\"kty\":\"EC\"` or `\"kty\":\"RSA\"`) key pair\n\n\n### Encrypting Content ###\n\nAt its simplest, to create a JWE:\n\n```javascript\n// {input} is a Buffer\njose.JWE.createEncrypt(key).\n        update(input).\n        final().\n        then(function(result) {\n          // {result} is a JSON Object -- JWE using the JSON General Serialization\n        });\n```\n\nHow the JWE content is encrypted depends on the provided Key.\n\n* If the Key only supports content encryption algorithms, then the preferred algorithm is used to encrypt the content and the key encryption algorithm (i.e., the \"alg\" member) is set to \"dir\".  The preferred algorithm is the first item returned by `key.algorithms(\"encrypt\")`.\n* If the Key supports key management algorithms, then the JWE content is encrypted using \"A128CBC-HS256\" by default, and the Content Encryption Key is encrypted using the preferred algorithms for the given Key.  The preferred algorithm is the first item returned by `key.algorithms(\"wrap\")`.\n\n\nTo create a JWE using a different serialization format:\n\n```javascript\njose.JWE.createEncrypt({ format: 'compact' }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // {result} is a String -- JWE using the Compact Serialization\n        });\n\njose.JWE.createEncrypt({ format: 'flattened' }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // {result} is a JSON Object -- JWE using the JSON Flattened Serialization\n        });\n```\n\nTo create a JWE and compressing the content before encrypting:\n\n```javascript\njose.JWE.createEncrypt({ zip: true }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\nTo create a JWE for a specific content type:\n\n```javascript\njose.JWE.createEncrypt({ fields: { cty : 'jwk+json' } }, key).\n        update(input).\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\nTo create a JWE with multiple recipients:\n\n```javascript\n// {keys} is an Array of jose.JWK.Key instances\njose.JWE.createEncrypt(keys).\n        update(input).\n        final().\n        then(function(result) {\n          // ....\n        });\n```\n\n### Decrypting a JWE ###\n\nTo decrypt a JWE, and retrieve the plaintext:\n\n```javascript\njose.JWE.createDecrypt(keystore).\n        decrypt(input).\n        then(function(result) {\n          // {result} is a Object with:\n          // *  header: the combined 'protected' and 'unprotected' header members\n          // *  protected: an array of the member names from the \"protected\" member\n          // *  key: Key used to decrypt\n          // *  payload: Buffer of the decrypted content\n          // *  plaintext: Buffer of the decrypted content (alternate)\n        });\n```\n\nTo decrypt a JWE using an implied key:\n\n```javascript\njose.JWE.createDecrypt(key).\n        decrypt(input).\n        then(function(result) {\n          // ....\n        });\n```\n\n#### Allowing (or Disallowing) Encryption Algorithms ###\n\nTo restrict what encryption algorithms are allowed when verifying, add the `algorithms` member to the `options` Object.  The `algorithms` member is either a string or an array of strings, where the string value(s) can be one of the following:\n\n* `\"*\"`: accept all supported algorithms\n* **`\u003calg name\u003e`** (e.g., `\"A128KW\"`): accept the specific algorithm (can have a single '*' to match a range of similar algorithms)\n* **`!\u003calg name\u003e`** (e.g., `\"!RSA1_5\"`): *do not* accept the specific algorithm (can have a single '*' to match a range of similar algorithms)\n\nThe negation is intended to be used with the wildcard accept string, and disallow takes precedence over allowed.\n\nTo only accept \"dir\" and AES-GCM encryption:\n\n```javascript\nvar opts = {\n  algorithms: [\"dir\", \"A*GCM\"]\n};\njose.JWE.createDecrypt(key, opts).\n        decrypt(input).\n        then(function(result) {\n          // ...\n        });\n```\n\nTo accept any algorithm, but disallow RSA-based encryption:\n\n```javascript\nvar opts = {\n  algorithms: [\"*\", \"!RSA*\"]\n};\njose.JWS.createVerify(key, opts).\n        verify(input).\n        then(function(result) {\n          // ...\n        });\n```\n\n#### Handling `crit` Header Members ####\n\nTo accept 'crit' field members, add the `handlers` member to the options Object.  The `handlers` member is itself an Object, where its member names are the `crit` header member, and the value is one of:\n\n* `Function`: takes the JWE decrypt output (just prior to decrypting) and returns a Promise for the processing of the member.\n* `Object`: An object with the following `Function` members:\n  * \"prepare\" -- takes the JWE decrypt output (just prior to decrypting) and returns a Promise for the processing of the member.\n  * \"complete\" -- takes the JWE decrypt output (immediately after decrypting) and returns a Promise for the processing of the member.\n\n**NOTE** If the handler function returns a promise, the fulfilled value is ignored.  It is expected these handler functions will modify the provided value directly.\n\nTo perform additional (pre-decrypt) processing on a `crit` header member:\n\n```javascript\nvar opts = {\n  handlers: {\n    \"exp\": function(jwe) {\n      // {jwe} is the JWE decrypt output, pre-decryption\n      jwe.header.exp = new Date(jwe.header.exp);\n    }\n  }\n};\njose.JWE.createDecrypt(key, opts).\n        decrypt(input).\n        then(function(result) {\n          // ...\n        });\n```\n\nTo perform additional (post-decrypt) processing on a `crit` header member:\n\n```javascript\nvar opts = {\n  handlers: {\n    \"exp\": {\n      complete: function(jwe) {\n        // {jwe} is the JWE decrypt output, post-decryption\n        jwe.header.exp = new Date(jwe.header.exp);\n      }\n    }\n  }\n};\njose.JWE.createDecrypt(key, opts).\n        decrypt(input).\n        then(function(result) {\n          // ...\n        });\n```\n\n## Useful Utilities ##\n\n### Converting to Buffer ###\n\nTo convert a [Typed Array](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Typed_arrays), [ArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer), or Array of Numbers to a Buffer:\n\n```javascript\nbuff = jose.util.asBuffer(input);\n```\n\n### URI-Safe Base64 ###\n\nThis exposes [urlsafe-base64](https://github.com/RGBboy/urlsafe-base64)'s `encode` and `decode` methods as `encode` and `decode` (respectively).\n\nTo convert from a Buffer to a base64uri-encoded String:\n\n```javascript\nvar output = jose.util.base64url.encode(input);\n```\n\nTo convert a String to a base64uri-encoded String:\n\n```javascript\n// explicit encoding\noutput = jose.util.base64url.encode(input, \"utf8\");\n\n// implied \"utf8\" encoding\noutput = jose.util.base64url.encode(input);\n```\n\nTo convert a base64uri-encoded String to a Buffer:\n\n```javascript\nvar output = jose.util.base64url.decode(input);\n```\n\n### Random Bytes ###\n\nTo generate a Buffer of octets, regardless of platform:\n\n```javascript\n// argument is size (in bytes)\nvar rnd = jose.util.randomBytes(32);\n```\n\nThis function uses:\n\n* `crypto.randomBytes()` on node.js\n* `crypto.getRandomValues()` on modern browsers\n* A PRNG based on AES and SHA-1 for older platforms\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcisco%2Fnode-jose","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcisco%2Fnode-jose","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcisco%2Fnode-jose/lists"}