Cloudflare Worker JWT

A lightweight JWT implementation with ZERO dependencies for Cloudflare Workers.

Contents

• Install
• Examples
• Usage
  • Sign
  • Verify
  • Decode

Install

npm i @tsndr/cloudflare-worker-jwt

Examples

Basic Example

import jwt from "@tsndr/cloudflare-worker-jwt"

async () => {

    // Create a token
    const token = await jwt.sign({
        sub: "1234",
        name: "John Doe",
        email: "[email protected]"
    }, "secret")

    // Verify token
    const verifiedToken = await jwt.verify(token, "secret")

    // Abort if token isn't valid
    if (!verifiedToken)
        return

    // Access token payload
    const { payload } = verifiedToken

    // { sub: "1234", name: "John Doe", email: "[email protected]" }
}

Restrict Timeframe

import jwt from "@tsndr/cloudflare-worker-jwt"

async () => {

    // Create a token
    const token = await jwt.sign({
        sub: "1234",
        name: "John Doe",
        email: "[email protected]",
        nbf: Math.floor(Date.now() / 1000) + (60 * 60),      // Not before: Now + 1h
        exp: Math.floor(Date.now() / 1000) + (2 * (60 * 60)) // Expires: Now + 2h
    }, "secret")

    // Verify token
    const verifiedToken = await jwt.verify(token, "secret")

    // Abort if token isn't valid
    if (!verifiedToken)
        return

    // Access token payload
    const { payload } = verifiedToken

    // { sub: "1234", name: "John Doe", email: "[email protected]", ... }
}

Usage

• Sign
• Verify
• Decode

---

Sign

sign(payload, secret, [options])

Signs a payload and returns the token.

Arguments

return

Returns token as a string.

---

Verify

verify(token, secret, [options])

Verifies the integrity of the token.

throws

Throws integration errors and if options.throwError is set to true also throws ALG_MISMATCH, NOT_YET_VALID, EXPIRED or INVALID_SIGNATURE.

return

Returns the decoded token or undefined.

{
    header: {
        alg: "HS256",
        typ: "JWT"
    },
    payload: {
        sub: "1234",
        name: "John Doe",
        email: "[email protected]"
    }
}

---

Decode

decode(token)

Just returns the decoded token without verifying verifying it. Please use verify() if you intend to verify it as well.

return

Returns an object containing header and payload:

{
    header: {
        alg: "HS256",
        typ: "JWT"
    },
    payload: {
        sub: "1234",
        name: "John Doe",
        email: "[email protected]"
    }
}

Available Algorithms

• ES256, ES384, ES512
• HS256, HS384, HS512
• RS256, RS384, RS512
• none