base64url.js

// TODO:
// Regex is slow but this is good enough for now

// data = string
const escape = data => {
  return data.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
}

// data = object
const encode = data => {
  return escape(Buffer.from(JSON.stringify(data)).toString('base64'))
}

// data = string
const decode = data => {
  return JSON.parse(Buffer.from(data, 'base64').toString())
}

module.exports = { escape, encode, decode }

jwt.js

const crypto = require('crypto')
const base64url = require('./base64url')

// header = string
const header = base64url.encode({ alg: 'HS256', typ: 'JWT' })

// data = string, key = string
const sign = (data, key) => {
  return crypto.createHmac('sha256', key).update(data).digest('base64')
}

// claims = { $string: string || number }, key = string
const encode = (claims, key) => {
  const data = header + '.' + base64url.encode(claims)
  return data + '.' + base64url.escape(sign(data, key))
}

// jwt = string, key = string
const verify = (jwt, key) => {
  const [header, payload, signature] = jwt.split('.')

  if (signature === base64url.escape(sign(header + '.' + payload, key))) {
    return {
      claims: base64url.decode(payload),
      verified: true
    }
  }

  return {
    verified: false
  }
}

module.exports = { encode, verify }

test.js

const jwt = require('./jwt)

const secret = crypto.randomBytes(256)

const token = encode({ exp: Date.now() + 3600000, sub: 123 }, secret)
const { claims, verified } = verify(token, secret)

console.log('token', token)
console.log('claims', claims)
console.log('verified', verified)