Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const idToken = tokenInfo.id_token;
// A token must exist to be valid.
if (!idToken) {
return null;
}
const tokenParts = idToken.split('.');
if (tokenParts.length !== 3) {
return null;
}
const payload
= rs.KJUR.jws.JWS.readSafeJSONString(rs.b64utoutf8(tokenParts[1]));
if (payload.nonce !== guids.authNonce
|| payload.aud !== appId
|| payload.iss
!== `https://login.microsoftonline.com/${payload.tid}/v2.0`) {
return null;
}
const now = new Date();
// Adjust by 5 minutes to allow for inconsistencies in system clocks.
const notBefore = new Date((payload.nbf - 300) * 1000);
const expires = new Date((payload.exp + 300) * 1000);
if (now < notBefore || now > expires) {
return null;
static parse(plain: Response): ?Session {
const token = plain.data.metadata ? plain.data.metadata.jwt : null;
let authorizations = [];
// Add authorizations from JWT
if (token) {
const isValid = jws.JWS.verifyJWT(token, swarmKey, { alg: ['RS256'], verifyAt: new Date() });
if (isValid) {
const decodedToken = jws.JWS.readSafeJSONString(b64utoutf8(token.split('.')[1]));
authorizations = decodedToken ? decodedToken.authorizations : [];
}
}
return new Session({
token: plain.data.token,
refreshToken: plain.data.refresh_token || null,
uuid: plain.data.metadata ? plain.data.metadata.uuid : null,
sessionUuid: plain.data.session_uuid,
authorizations,
tenantUuid: plain.data.metadata ? plain.data.metadata.tenant_uuid : undefined,
expiresAt: new Date(`${plain.data.utc_expires_at}z`),
});
}