jose

v5.2.4

JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes For more information about how to use this package see README

Latest version published 13 days ago

License: MIT

NPM

GitHub

Package Health Score

94 / 100

security
No known security issues
popularity
Key ecosystem project
maintenance
Healthy
community
Active

Explore Similar Packages

Security

No known security issues

All security vulnerabilities belong to production dependencies of direct and indirect packages.

Security and license risk for significant versions

All Versions

Version				Vulnerabilities	License Risk
5.2.4	\|	04/2024		0 C 0 H 0 M 0 L	0 H 0 M 0 L
4.15.5	\|	03/2024	Popular	0 C 0 H 0 M 0 L	0 H 0 M 0 L
5.1.3	\|	11/2023		0 C 0 H 0 M 0 L	0 H 0 M 0 L
3.20.4	\|	09/2022		0 C 0 H 1 M 0 L	0 H 0 M 0 L
3.19.0	\|	09/2021		0 C 0 H 2 M 0 L	0 H 0 M 0 L

License

MIT

Security Policy

Is your project affected by vulnerabilities?

Scan your projects for vulnerabilities. Fix quickly with automated fixes. Get started with Snyk for free.

Get started free

Popularity

Key ecosystem project

Weekly Downloads (9,228,861)

GitHub Stars: 4.74K
Forks: 293
Contributors: 40

Direct Usage Popularity

The npm package jose receives a total of 9,228,861 downloads a week. As such, we scored jose popularity level to be Key ecosystem project.

Based on project statistics from the GitHub repository for the npm package jose, we found that it has been starred 4,737 times.

Downloads are calculated as moving averages for a period of the last 12 months, excluding weekends and known missing data points.

Community

Active

Readme.md: Yes
Contributing.md: Yes
Code of Conduct: Yes
Contributors: 40
Funding: Yes

With more than 10 contributors for the jose repository, this is possibly a sign for a growing and inviting community.

Embed Package Health Score Badge

Maintenance

Healthy

Commit Frequency

Open Issues: 1
Open PR: 0
Last Release: 13 days ago
Last Commit: 12 days ago

Further analysis of the maintenance status of jose based on released npm versions cadence, the repository activity, and other data points determined that its maintenance is Healthy.

We found that jose demonstrates a positive version release cadence with at least one new version released in the past 3 months.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Keep your project healthy

Check your package.json

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Node.js Compatibility: not defined

Age: 10 years
Dependencies: 0 Direct
Versions: 194
Install Size: 504 kB
Dist-tags: 2
# of Files: 275
Maintainers: 1
TS Typings: No

jose has more than a single and default latest tag published for the npm package. This means, there may be other tags available for this package, such as next to indicate future releases, or stable to indicate stable releases.

Not sure how to use jose?

To help you get started, we've collected the most common ways that jose is being used within popular public projects.

panva / node-oidc-provider / test / run.js View on Github

async function singleRun() {
  clearRequireCache();
  const jose = require('jose'); // eslint-disable-line global-require
  global.keystore = new jose.JWKS.KeyStore();
  await Promise.all([
    global.keystore.generate('RSA', 2048),
    global.keystore.generate('EC', 'P-256'),
    runtimeSupport.EdDSA ? global.keystore.generate('OKP', 'Ed25519') : undefined,
  ]);
  const DEFAULTS = require('../lib/helpers/defaults'); // eslint-disable-line global-require
  if (this.format === 'jwt-ietf' || typeof this.format === 'function') {
    DEFAULTS.features.ietfJWTAccessTokenProfile.enabled = true;
    DEFAULTS.features.ietfJWTAccessTokenProfile.ack = 2;
  }
  DEFAULTS.formats.AccessToken = this.format;
  DEFAULTS.formats.ClientCredentials = this.format;

  process.env.MOUNT_VIA = process.env.MOUNT_VIA || '';
  process.env.MOUNT_TO = process.env.MOUNT_TO || '/';

View more ways to use jose

jose

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.

💗 Help the project

Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.

Dependencies: 0

jose has no dependencies and it exports tree-shakeable ESM. CJS is also supported.

Documentation

jose is distributed via npmjs.com, deno.land/x, cdnjs.com, jsdelivr.com, and github.com.

example ESM import

import * as jose from 'jose'

example CJS require

const jose = require('jose')

JSON Web Tokens (JWT)

The jose module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.

JWT Claims Set Validation & Signature Verification using the jwtVerify function
- Using a remote JSON Web Key Set (JWKS)
- Using a local JSON Web Key Set (JWKS)
Signing using the SignJWT class
Utility functions
- Decoding Token's Protected Header
- Decoding JWT Claims Set prior to its validation

Encrypted JSON Web Tokens

The jose module supports encrypted JSON Web Tokens and provides functionality for encrypting and decrypting tokens, as well as their JWT Claims Set validation.

Decryption & JWT Claims Set Validation using the jwtDecrypt function
Encryption using the EncryptJWT class
Utility functions
- Decoding Token's Protected Header

Key Utilities

The jose module supports importing, exporting, and generating keys and secrets in various formats, including PEM formats like SPKI, X.509 certificate, and PKCS #8, as well as JSON Web Key (JWK).

Key Import Functions
Key and Secret Generation Functions
- Asymmetric Key Pair Generation
- Symmetric Secret Generation
Key Export Functions

JSON Web Signature (JWS)

The jose module supports signing and verification of JWS messages with arbitrary payloads in Compact, Flattened JSON, and General JSON serialization syntaxes.

Signing - Compact, Flattened JSON, General JSON
Verification - Compact, Flattened JSON, General JSON
- Using a remote JSON Web Key Set (JWKS)
- Using a local JSON Web Key Set (JWKS)
Utility functions
- Decoding Token's Protected Header

JSON Web Encryption (JWE)

The jose module supports encryption and decryption of JWE messages with arbitrary plaintext in Compact, Flattened JSON, and General JSON serialization syntaxes.

Encryption - Compact, Flattened JSON, General JSON
Decryption - Compact, Flattened JSON, General JSON
Utility functions
- Decoding Token's Protected Header

Other

The following are additional features and utilities provided by the jose module:

Implemented specifications

The jose module implements the following specifications:

JSON Web Signature (JWS) - RFC7515
JSON Web Encryption (JWE) - RFC7516
JSON Web Key (JWK) - RFC7517
JSON Web Algorithms (JWA) - RFC7518
JSON Web Token (JWT) - RFC7519
JSON Web Key Thumbprint - RFC7638
JSON Web Key Thumbprint URI - RFC9278
JWS Unencoded Payload Option - RFC7797
CFRG Elliptic Curve ECDH and Signatures - RFC8037
secp256k1 EC Key curve support - RFC8812

The algorithm implementations have been tested using test vectors from their respective specifications as well as RFC7520.

Supported Runtimes

The jose module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.

The following runtimes are supported (this is not an exhaustive list):

Please note that certain algorithms may not be available depending on the runtime used. You can find a list of available algorithms for each runtime in the specific issue links provided above.

Supported Versions

Version	Security Fixes 🔑	Other Bug Fixes 🐞	New Features ⭐
v5.x	✅	✅	✅
v4.x	✅	❌	❌
v2.x	✅	❌	❌

FAQs

What is jose?

JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes. Visit Snyk Advisor to see a full health score report for jose, including popularity, security, maintenance & community analysis.

Is jose popular?

The npm package jose receives a total of 9,228,861 weekly downloads. As such, jose popularity was classified as a key ecosystem project. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is jose well maintained?

We found that jose demonstrated a healthy version release cadence and project activity. It has a community of 40 open source contributors collaborating on the project. See the full package health analysis to learn more about the package maintenance status.

Is jose safe to use?

The npm package jose was scanned for known vulnerabilities and missing license, and no issues were found. Thus the package was deemed as safe to use. See the full health analysis review.

Last updated on 19 April-2024, at 14:47 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP

Package Health Score

Explore Similar Packages

Security and license risk for significant versions

Is your project affected by vulnerabilities?

Weekly Downloads (9,228,861)

Direct Usage Popularity

Embed Package Health Score Badge

Commit Frequency

Keep your project healthy

Check your package.json

Snyk Vulnerability Scanner

Not sure how to use jose?

jose

💗 Help the project

Dependencies: 0

Documentation

JSON Web Tokens (JWT)

Encrypted JSON Web Tokens

Key Utilities

JSON Web Signature (JWS)

JSON Web Encryption (JWE)

Other

Implemented specifications

Supported Runtimes

Supported Versions

FAQs

What is jose?

Is jose popular?

Is jose well maintained?

Is jose safe to use?

Build a secure application checklist

Select a recommended open source package

Scan your app for vulnerabilities

Source Code

Open Source

Container

Config

Fix identified vulnerabilities

Monitor for new issues