{"repo":"frasertweedale/hs-jose","free":true,"listed":false,"github":"https://github.com/frasertweedale/hs-jose","clone":"git clone https://github.com/frasertweedale/hs-jose.git","description":"Haskell JOSE and JWT library","language":"Haskell","stars":136,"topics":["cryptography","jose","jwt","json","haskell","jwk","jws"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"jose - JSON Object Signing and Encryption & JWT (JSON Web Token) jose is a Haskell implementation of JSON Object Signing and Encryption (JOSE) and JSON Web Token (JWT). The JSON Web Signature (JWS; RFC 7515) implementation is complete. JSON Web Encryption (JWE; RFC 7516) is not yet implemented. EdDSA signatures (RFC 8037) and secp256k1 signatures (RFC 8812) are supported. JWK Thumbprint (RFC 7638) is supported. Contributions are welcome. Security If you discover a security issue in this library, please email me the details, ideally with a proof of concept ( frase @ frase.id.au ; PGP key). Before reporting an issue, please note the following known vulnerabilities: - The ECDSA implementation is vulnerable to timing attacks and should therefore only be used for verification. and the following known not-vulnerabilities : - The library is not vulnerable to JWS algorithm substitution attacks . Haskell's type system excludes this attack. - The default JWS validation settings reject the \"none\" algorithm , as required by RFC 7518. - The library is not vulnerable to ECDH invalid curve attacks because JWE is not implemented. Interoperability issues The following known interoperability issues will not be addressed, so please do not open issues: - Some JOSE tools and libraries permit the use of short keys , in violation of the RFCs. This implementation rejects JWS or JWT objects minted with short keys, as required by the RFCs. - The Auth0 software produces objects with an invalid \"x5t\" pa","default_branch":null,"files":null,"tree":[],"storefront":"/r/frasertweedale","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/frasertweedale/hs-jose/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}