GitHub - davedoesdev/python-jwt: Python module for generating and verifying JSON Web Tokens (original) (raw)

Module for generating and verifying JSON Web Tokens.

All versions of python-jwt are now DEPRECATED. I don't have the time to maintain this module.

• Note: Versions 3.3.4 and later fix a vulnerability (CVE-2022-39227) in JSON Web Token verification which lets an attacker with a valid token re-use its signature with modified claims. CVE to follow. Please upgrade!
• Note: From version 2.0.1 the namespace has changed from jwt to python_jwt, in order to avoid conflict with PyJWT.
• Note: Versions 1.0.0 and later fix a vulnerability in JSON Web Token verification so please upgrade if you're using this functionality. The API has changed so you will need to update your application. verify_jwt now requires you to specify which signature algorithms are allowed.
• Uses jwcrypto to do the heavy lifting.
• Supports RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, ES256, ES384, ES512, ES256K, EdDSA and none signature algorithms.
• Unit tests, including tests for interoperability with jose.
• Supports Python 3.6+. Note: generate_jwt returns the token as a Unicode string.

Example:

import python_jwt as jwt, jwcrypto.jwk as jwk, datetime key = jwk.JWK.generate(kty='RSA', size=2048) payload = { 'foo': 'bar', 'wup': 90 }; token = jwt.generate_jwt(payload, key, 'PS256', datetime.timedelta(minutes=5)) header, claims = jwt.verify_jwt(token, key, ['PS256']) for k in payload: assert claims[k] == payload[k]

The API is described here.

Installation

Another Example

You can read and write keys from and to PEM-format strings:

import python_jwt as jwt, jwcrypto.jwk as jwk, datetime key = jwk.JWK.generate(kty='RSA', size=2048) priv_pem = key.export_to_pem(private_key=True, password=None) pub_pem = key.export_to_pem() payload = { 'foo': 'bar', 'wup': 90 }; priv_key = jwk.JWK.from_pem(priv_pem) pub_key = jwk.JWK.from_pem(pub_pem) token = jwt.generate_jwt(payload, priv_key, 'RS256', datetime.timedelta(minutes=5)) header, claims = jwt.verify_jwt(token, pub_key, ['RS256']) for k in payload: assert claims[k] == payload[k]

Licence

MIT

Tests

Lint

Code Coverage

coverage.py results are available here.

Coveralls page is here.

Benchmarks

Here are some results on a laptop with an Intel Core i5-4300M 2.6Ghz CPU and 8Gb RAM running Ubuntu 17.04.