JWS support added in existing plugin #71

e159669 · 2025-11-04T12:13:49Z

This plugin can take care of generating jws signature creation and/or jws signature verification. To enable jws signing support,
you need to configure in the environment the signatureConfig property.

e159669 · 2025-11-11T10:02:49Z

Please refer this document for JWS support design document and use case summary
Uploading JWS.Signature.Support.-design.document.docx…

sonarqubecloud · 2025-11-11T14:30:55Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

joseph-neeraj

If you have a design/requirement doc for this.Please send us a link.
The JWS header seems to use custom configuration, with an iat in the header and crit iat. We need some context on this. If this is a one off and not the generic design across APIs in Mastercard, we'll have to re-think if this should be merged to the common/public repo.

README.md

src/mastercard-context.js

src/signature/jws.js

src/utils/validator.js

src/signature/jws.js

src/signature/jws-signature.js

src/signature/jws.js

joseph-neeraj · 2025-11-14T15:39:42Z

src/signature/jws.js

+ const jwsHeaders = jwsParts[0];
+ const jwsSignature = jwsParts[2];
+ const jwsSign = jwsHeaders + '.' + jwsPayload + '.' + jwsSignature;
+ const isVerified = KJUR.jws.JWS.verify(jwsSign, publicKeyPEM, [algo]);


Does this response JWS header have the crit: [ "iat" ] and "iat" keys ? if so is it verified here ?

Note: Please refer to this comment , to decide whether this change needs to be implemented or not.

iat in the header is a custom header value as far as I can tell.
Nothing in the code or jsrassign's docs suggest that it will be checked automatically.
the lib only seems to be verifying the signature here.
Please verify iat here.

joseph-neeraj · 2025-11-14T16:18:40Z

Please refer this document for JWS support design document and use case summary Uploading JWS.Signature.Support.-design.document.docx…

The link directs to this page again, please mail us the valid link.

joseph-neeraj · 2025-11-28T14:58:42Z

Hello @joseph-neeraj @karen-avetisyan-mc Please refer below links for understanding the design and implementation of this JWS Digital Signature Guide | Account to Account Commerce for Creditor Service Providers | Mastercard D…](https://developer.mastercard.com/account-to-account-commerce-for-csp/documentation/tutorials-and-guides/jws-guide/)

I've removed the internal link.
The JWS signing guide seems to be for a specific platform, we'll need to discuss this internally to see if this should be merged to the public repo. A lot of the implementation details seem to be custom, just specific to the Zapp platform. We'll check this and let you know if we should go ahead with merging the PR to this repo.

joseph-neeraj · 2025-11-28T12:35:17Z

src/signature/jws.js

+
+function jwsVerify(jws, expectedPayload, publicKeyPEM, algo) {
+ const stringPayload = JSON.stringify(expectedPayload);
+ const jwsPayload =  Buffer.from(stringPayload, 'binary').toString('base64url');


Same as my previous comment, please check this again, as per nodejs' documentation 'binary' is an alias for 'latin1', so any unicode character which does not fit into latin1 will be truncated.
the english alphabet will fit but a lot of other characters won't and will result in data loss, resulting in incorrect signature computation. Please use utf-8 when reading the string to the buffer and see if it works.

Suggested change

const jwsPayload = Buffer.from(stringPayload, 'binary').toString('base64url');

const jwsPayload = Buffer.from(stringPayload, 'utf-8').toString('base64url');

joseph-neeraj · 2025-11-28T13:55:57Z

src/signature/jws.js

+ const jwsHeaders = jwsParts[0];
+ const jwsSignature = jwsParts[2];
+ const jwsSign = jwsHeaders + '.' + jwsPayload + '.' + jwsSignature;
+ const isVerified = KJUR.jws.JWS.verify(jwsSign, publicKeyPEM, [algo]);


Note: Please refer to this comment , to decide whether this change needs to be implemented or not.

iat in the header is a custom header value as far as I can tell.
Nothing in the code or jsrassign's docs suggest that it will be checked automatically.
the lib only seems to be verifying the signature here.
Please verify iat here.

joseph-neeraj · 2025-11-28T14:05:28Z

src/signature/jws-signature.js

+    const requestConfig = utils.getRequestConfig(mcContext.signatureConfig, mcContext.url);
+
+    if (!requestConfig) {
+      return
+    }


Please move these to the line just after
const mcContext = new MastercardContext(context);

None of the payload or signature calculations matter if the request does not have any signature configuration.

joseph-neeraj · 2025-11-28T14:09:45Z

src/signature/jws-signature.js

+      const url = new URL(requestUrl);
+      payload = url.pathname + url.search;
+    } else {
+      payload = body.text ? body.text : undefined;


The check has already been done by hasBody

Suggested change

payload = body.text ? body.text : undefined;

payload = body.text

joseph-neeraj · 2025-11-28T14:29:34Z

src/signature/jws.js

+
+function jwsSign(payload, KID, privateKeyPEM, algo) {
+
+const header = {     "alg": algo,    "kid": KID,    "crit": [        "iat"    ],    "iat": KJUR.jws.IntDate.get("now").toString()};


As per the implementation guide iat is a number. Please fix this. I suppose it needs to be fixed on the server side as well .

joseph-neeraj · 2025-11-28T14:34:47Z

src/signature/jws.js

+  return detachedJWS;
+}
+
+function jwsVerify(jws, expectedPayload, publicKeyPEM, algo) {


Note that these suggestions are applicable only if we don't merge the PR to this repo.
These are requirements for the zapp platform and may not be applicable in a generic sense.
So please hold off implementing these until we decide on whether these are going into this repo.

A few checks from the implementation guide are missing here:

Check that crit header only contains iat.

alg should only be RS256.

Verify the iat header value. It should be a number and within tolerance levels to account for network delays/clock skews.

e159669 added 2 commits November 4, 2025 00:11

JWS support added

b7f2443

Merge remote-tracking branch 'origin/main'

737495d

karen-avetisyan-mc added the safe The PR has been reviewed by Mastercard and has been validated to be safe label Nov 4, 2025

e159669 added 9 commits November 4, 2025 19:32

Merge remote-tracking branch 'origin/main'

e2bb032

Merge remote-tracking branch 'origin/main'

5ea1b80

Merge remote-tracking branch 'origin/main'

fb085f7

Merge remote-tracking branch 'origin/main'

e90efab

test cases added

6fede48

test cases added

f97bc89

test cases added

f5ffd0e

sonar issues resolved

f606faa

sonar issues resolved - hotspots

e0bf122

e159669 added 2 commits November 11, 2025 17:01

sonar issues resolved - Issues

9e2e636

sonar issues resolved

5600e28

karen-avetisyan-mc requested review from ShimonaR-MC, joseph-neeraj and karen-avetisyan-mc November 11, 2025 14:17

linter issue resolution

b4fdf58

joseph-neeraj requested changes Nov 14, 2025

View reviewed changes

e159669 requested a review from joseph-neeraj November 19, 2025 13:41

Review comments addressed

ebfa3a9

This comment was marked as off-topic.

Sign in to view

addressed the suggestions

9e8d8f6

joseph-neeraj requested changes Nov 28, 2025

View reviewed changes

	const jwsPayload = Buffer.from(stringPayload, 'binary').toString('base64url');
	const jwsPayload = Buffer.from(stringPayload, 'utf-8').toString('base64url');

	payload = body.text ? body.text : undefined;
	payload = body.text


		function jwsSign(payload, KID, privateKeyPEM, algo) {

		const header = { "alg": algo, "kid": KID, "crit": [ "iat" ], "iat": KJUR.jws.IntDate.get("now").toString()};

JWS support added in existing plugin #71

Are you sure you want to change the base?

JWS support added in existing plugin #71

Uh oh!

Conversation

e159669 commented Nov 4, 2025

Uh oh!

e159669 commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Nov 11, 2025

Quality Gate passed

Uh oh!

joseph-neeraj left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joseph-neeraj Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joseph-neeraj commented Nov 14, 2025

Uh oh!

This comment was marked as off-topic.

joseph-neeraj commented Nov 28, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

e159669 commented Nov 11, 2025 •

edited

Loading

joseph-neeraj left a comment •

edited

Loading

joseph-neeraj Nov 14, 2025 •

edited

Loading