(Node.js) Verify JWT with EdDSA / Ed25519 Signature

Note: This example requires Chilkat v9.5.0.84 or greater.

Demonstrates how to verify a JWT that was signed using an Ed25519 private key.

This example verifies the EdDSA signature. It also does the following:

• Checks to see if the time constraints ("nbf" and "exp") are valid.
• Recovers the original JOSE header.
• Recovers the original data.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // Demonstrates how to verify a JWT with an EdDSA/Ed25519 Signature
    // *** Requires Chilkat v9.5.0.84 or greater.

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Use this Ed25519 public key for verification

    var jsonPubKey = "{\"kty\": \"OKP\",\"alg\": \"EdDSA\",\"crv\": \"Ed25519\",\"x\": \"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo\"}";

    var pubKey = new chilkat.PublicKey();
    var success = pubKey.LoadFromString(jsonPubKey);
    if (success == false) {
        console.log(pubKey.LastErrorText);
        return;
    }

    var jwt = new chilkat.Jwt();
    var token = "eyJhbGciOiJFZERTQSJ9.RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc.hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt9g7sVvpAr_MuM0KAg";

    // First verify the signature.
    var sigVerified = jwt.VerifyJwtPk(token,pubKey);
    console.log("verified: " + sigVerified);

    if (sigVerified == false) {
        console.log(jwt.LastErrorText);
        return;
    }

    // Let's see if the time constraints, if any, are valid.
    // The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
    // If the current system time is before the "nbf" time, or after the "exp" time,
    // then IsTimeValid will return false/0.
    // Also, we'll allow a leeway of 60 seconds to account for any clock skew.
    // Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
    var leeway = 60;
    var bTimeValid = jwt.IsTimeValid(token,leeway);
    console.log("time constraints valid: " + bTimeValid);

    // Recover the original data (the payload).
    var payload = jwt.GetPayload(token);
    console.log(payload);

    // Recover the original JOSE header in the same way:
    var joseHeader = jwt.GetHeader(token);
    console.log(joseHeader);

}

chilkatExample();