Status

Features

• Secure Serialization: Convert JavaScript objects to safe, URL-friendly strings that can be signed to protect against tampering.
• Timed Signatures: Add timestamps to signatures, enabling support for expiring tokens.
• Secret Key Rotation: Manage multiple keys for signing, supporting key rotation for enhanced security.
• Flexible Algorithms: Supports different cryptographic algorithms like HMAC with SHA1, SHA256, SHA512, etc.
• Payload Compression: Automatically compress and decompress payloads to optimize storage and transmission.
• URL-Safe Formats: Encodes data into URL-safe strings, perfect for embedding in URLs or cookies.

Installation

npm install itsdangerous.js

Usage

Below are some practical use cases and basic examples. For more examples, see the examples directory.

Use Cases

• Tokenized URLs: Sign user IDs or other data in URLs (e.g., unsubscribe links) to eliminate the need for storing one-time tokens in the database.

• Stateless Sessions: Store signed objects in cookies or other untrusted sources, removing the need for server-side session storage.

• Round-Trip Data: Safely pass server-side state to the client and back, verifying its integrity upon return.

Basic Serialization and Signing

URL-Safe Serialization

import {URLSafeSerializer} from 'itsdangerous.js';

const authSerializer = new URLSafeSerializer({secretKey: 'secret key', salt: 'auth'});
const token = await authSerializer.stringify({id: 5, name: 'itsdangerous'});

console.log(token); // eyJpZCI6NSwibmFtZSI6Iml0c2Rhbmdlcm91cyJ9.6YP6T0BaO67XP--9UzTrmurXSmg

const data = await authSerializer.parse(token);
console.log(data.name); // itsdangerous

Timed Signatures

import {URLSafeTimedSerializer} from 'itsdangerous.js';

const authSerializer = new URLSafeTimedSerializer({secretKey: 'secret key', salt: 'auth'});
const token = await authSerializer.stringify({id: 5, name: 'itsdangerous'});

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
try {
	await sleep(6000);
	// This will throw an error if the token has expired
	const data = await authSerializer.parse(token, undefined, 5, true);
} catch (err) {
	console.log(err.name); // SignatureExpiredError
	console.log(err.message); // Signature age 6 > 5 seconds
}

License

This project is licensed under the MIT license.

Contributing

We welcome contributions! Please read CONTRIBUTING.md for details on how to get involved and submit your changes.