Repository navigation

fix(jose): typed PASETO keys, JWE header integrity, JSON limits, key-import perf - #80

Merged

ExorTek merged 21 commits into

masterfrom

fix/jose-audit-hardening

Oct 24, 2026

Merged

fix(jose): typed PASETO keys, JWE header integrity, JSON limits, key-import perf#80
ExorTek merged 21 commits into
masterfrom
fix/jose-audit-hardening

Commits on Oct 24, 2026
- feat(paseto)!: typed keys with purpose separation
  ExorTek
  committed
  bc2917c
- fix(oauth2): pasetoIssuer takes typed PASETO keys
  ExorTek
  committed
  947db5b
- fix(paseto): token-pair passes durations in the right unit
  ExorTek
  committed
  5b6204b
- fix(paseto): reject a token with an empty footer segment
  ExorTek
  committed
  dc66bd6
- fix(paseto): claim requirements need a claims-object payload
  ExorTek
  committed
  5e921a8
- fix(jwt)!: signed refresh tokens are typed and keyed apart
  ExorTek
  committed
  7414ef4
- fix(paseto): token-pair refresh tokens need their own key
  ExorTek
  committed
  ba7ec25
- fix(jwt): HMAC algorithms reject PEM keys with INVALID_KEY
  ExorTek
  committed
  0f9e15e
- fix(jws): bound verifyJson by size and signature count
  ExorTek
  committed
  be2936e
- fix(jwe): bound decryptJson by size and recipient count
  ExorTek
  committed
  b45ab0e
- fix(jwe)!: JSON headers must be disjoint; protectedHeader is protected only
  ExorTek
  committed
  4a6632b
- fix(jwe): reject zip instead of returning compressed bytes
  ExorTek
  committed
  6bd1ebb
- fix(jwks): alg cross-check also covers keys found by a refetch
  ExorTek
  committed
  ce3c5d6
- fix(shared): JWK keys honour their declared alg, use and key_ops
  ExorTek
  committed
  54bd2ee
- fix(jwk): toPublic refuses unknown key types
  ExorTek
  committed
  c5a547d
- perf(shared): HMAC on the KeyObject, ECDSA in IEEE P1363 form
  ExorTek
  committed
  837fc80
- perf(shared,jwt,jwks): import each key once instead of per verification
  ExorTek
  committed
  ee88d63
- perf(paseto): BLAKE2b on 32-bit lanes instead of BigInt
  ExorTek
  committed
  0fd4469
- docs(paseto): typed keys, refresh key separation, duration units
  ExorTek
  committed
  f193c09
- docs(jose): JSON serialization limits, disjoint JWE headers, key checks
  ExorTek
  committed
  2c71f5e
- chore: changesets for JOSE hardening
  ExorTek
  committed
  542bdb9

Commits

Commits on Oct 24, 2026