Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add JWT string validator #3887

Closed

Conversation

Mokshit06
Copy link
Contributor

This PR retroactively implements the jwt string format in Zod v3. Resolves #2946

Supports the following API:

z.string().jwt() // checks for jwt format
z.string().jwt({ alg?: string }) // with optional algorithm

Validates:

  • Three-part JWT structure (header.payload.signature)
  • Base64 encoding of all parts
  • Header contains required 'typ' and 'alg' fields
  • Optional algorithm validation when specified

Link to Devin run: https://preview.devin.ai/sessions/7aa913c03a7d4ce0b5c8f87d2ce59ec5

- Add JWT validation to string schema
- Implement validation in _parse method
- Add comprehensive test coverage
- Support optional algorithm validation
- Maintain cross-runtime compatibility
Copy link

netlify bot commented Dec 6, 2024

Deploy Preview for guileless-rolypoly-866f8a ready!

Built without sensitive environment variables

Name Link
🔨 Latest commit 2e189ec
🔍 Latest deploy log https://app.netlify.com/sites/guileless-rolypoly-866f8a/deploys/675395227ab0940008b810a2
😎 Deploy Preview https://deploy-preview-3887--guileless-rolypoly-866f8a.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link
Owner

@colinhacks colinhacks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also Prettier is failing, run yarn prettier:fix to fix that.

src/types.ts Outdated

// Validate algorithm if specified
if (check.options?.alg && header.alg !== check.options.alg) {
throw new Error();
Copy link
Owner

@colinhacks colinhacks Dec 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid throwing errors in hot path for performance reasons

src/types.ts Outdated

// Decode and validate header
const header = JSON.parse(atob(parts[0]));
if (!header.typ || !header.alg) throw new Error();
Copy link
Owner

@colinhacks colinhacks Dec 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid throwing errors in hot path for performance reasons

src/types.ts Outdated
try {
// Validate all parts are base64
for (const part of parts) {
if (!base64Regex.test(part)) throw new Error();
Copy link
Owner

@colinhacks colinhacks Dec 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid throwing errors in hot path for performance reasons

@@ -943,6 +963,41 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
});
status.dirty();
}
} else if (check.kind === "jwt") {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

try splitting the JWT validation into a standalone utility function

const parts = input.data.split(".");
if (parts.length !== 3) {
ctx = this._getOrReturnCtx(input, ctx);
addIssueToContext(ctx, {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

structure the code to avoid multiple calls to addIssueToContext for bundle size reasons

@Mokshit06
Copy link
Contributor Author

Thanks for the review! The throwing error part + JSON.parse errors should get catched by the catch block and handled with addIssueToContext. Unless we want different validation messages for each of them

@Mokshit06 Mokshit06 closed this Dec 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add support for jwt
2 participants