feat: LRU cache key

README.md

@@ -176,6 +176,8 @@ Create a verifier function by calling `createVerifier` and providing one or more
 
 - `clockTolerance`: Timespan in milliseconds is the tolerance to apply to the current timestamp when performing time comparisons. Default is `0`.
 
+- `cacheKeyBuilder`: The function that will be used to create the [cache's key](#caching). To avoid sensitive informations leaking, by default is used [the hashToken function](./src/utils.js).
+
 The verifier is a function which accepts a token (as Buffer or string) and returns the payload or the sections of the token.
 
 If the `key` option is a function, the signer will also accept a Node style callback and will return a promise, supporting therefore both callback and async/await styles.

src/verifier.js

@@ -80,7 +80,8 @@ function cacheSet(
     maxAge,
     clockTimestamp,
     clockTolerance,
-    errorCacheTTL
+    errorCacheTTL,
+    cacheKeyBuilder
   },
   value
 ) {
@@ -93,7 +94,7 @@ function cacheSet(
   if (value instanceof TokenError) {
     const ttl = typeof errorCacheTTL === 'function' ? errorCacheTTL(value) : errorCacheTTL
     cacheValue[2] = (clockTimestamp || Date.now()) + clockTolerance + ttl
-    cache.set(hashToken(token), cacheValue)
+    cache.set(cacheKeyBuilder(token), cacheValue)
     return value
   }
 
@@ -116,7 +117,7 @@ function cacheSet(
   const maxTTL = (clockTimestamp || Date.now()) + clockTolerance + cacheTTL
   cacheValue[2] = cacheValue[2] === 0 ? maxTTL : Math.min(cacheValue[2], maxTTL)
 
-  cache.set(hashToken(token), cacheValue)
+  cache.set(cacheKeyBuilder(token), cacheValue)
 
   return value
 }
@@ -258,7 +259,8 @@ function verify(
     decode,
     cache,
     requiredClaims,
-    errorCacheTTL
+    errorCacheTTL,
+    cacheKeyBuilder
   },
   token,
   cb
@@ -275,12 +277,13 @@ function verify(
     ignoreNotBefore,
     maxAge,
     clockTimestamp,
-    clockTolerance
+    clockTolerance,
+    cacheKeyBuilder
   }
 
   // Check the cache
   if (cache) {
-    const [value, min, max] = cache.get(hashToken(token)) || [undefined, 0, 0]
+    const [value, min, max] = cache.get(cacheKeyBuilder(token)) || [undefined, 0, 0]
     const now = clockTimestamp || Date.now()
 
     // Validate time range
@@ -392,8 +395,9 @@ module.exports = function createVerifier(options) {
     allowedIss,
     allowedSub,
     allowedNonce,
-    requiredClaims
-  } = { cacheTTL: 600000, clockTolerance: 0, errorCacheTTL: -1, ...options }
+    requiredClaims,
+    cacheKeyBuilder
+  } = { cacheTTL: 600000, clockTolerance: 0, errorCacheTTL: -1, cacheKeyBuilder: hashToken, ...options }
 
   // Validate options
   if (!Array.isArray(allowedAlgorithms)) {
@@ -516,7 +520,8 @@ module.exports = function createVerifier(options) {
     validators,
     decode: createDecoder({ complete: true }),
     cache: createCache(cacheSize),
-    requiredClaims
+    requiredClaims,
+    cacheKeyBuilder
   }
 
   // Return the verifier

test/verifier.spec.js

@@ -1021,6 +1021,27 @@ test('caching - sync', t => {
   t.assert.ok(verifier.cache.get(hashToken(invalidToken))[0] instanceof TokenError)
 })
 
+test('caching - sync - custom cacheKeyBuilder', t => {
+  const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxfQ.57TF7smP9XDhIexBqPC-F1toZReYZLWb_YRU5tv0sxM'
+  const invalidToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxfQ.aaa'
+
+  const verifier = createVerifier({ key: 'secret', cache: true, cacheKeyBuilder: (id) => id })
+
+  t.assert.equal(verifier.cache.size, 0)
+  t.assert.deepStrictEqual(verifier(token), { a: 1 })
+  t.assert.equal(verifier.cache.size, 1)
+  t.assert.deepStrictEqual(verifier(token), { a: 1 })
+  t.assert.equal(verifier.cache.size, 1)
+
+  t.assert.throws(() => verifier(invalidToken), { message: 'The token signature is invalid.' })
+  t.assert.equal(verifier.cache.size, 2)
+  t.assert.throws(() => verifier(invalidToken), { message: 'The token signature is invalid.' })
+  t.assert.equal(verifier.cache.size, 2)
+
+  t.assert.deepStrictEqual(verifier.cache.get(token)[0], { a: 1 })
+  t.assert.ok(verifier.cache.get(invalidToken)[0] instanceof TokenError)
+})
+
 test('caching - async', async t => {
   const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxfQ.57TF7smP9XDhIexBqPC-F1toZReYZLWb_YRU5tv0sxM'
   const invalidToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxfQ.aaa'