<commit_before># Delphi JOSE and JWT Library

![Image of Delphi-JOSE Demo](http://paolo-rossi.github.io/delphi-jose-jwt/images/jose-delphi.png)

[Delphi](http://www.embarcadero.com/products/delphi) implementation of JWT (JSON Web Token) and the JOSE (JSON Object Signing and Encryption) specification suite. This library supports the JWS (JWE is support planned) compact serializations with several JOSE algorithms.

## What is JOSE

[JOSE](https://tools.ietf.org/html/rfc7520) is a standard that provides a general approach to signing and encryption of any content. JOSE consists of several RFC:

- [JWT (JSON Web Token)](https://tools.ietf.org/html/rfc7519) - describes representation of claims encoded in JSON
- [JWS (JSON Web Signature)](https://tools.ietf.org/html/rfc7515) - describes producing and handling signed messages
- [JWE (JSON Web Encryption)](https://tools.ietf.org/html/rfc7516) - describes producing and handling encrypted messages
- [JWA (JSON Web Algorithms)](https://tools.ietf.org/html/rfc7518) - describes cryptographic algorithms used in JOSE
- [JWK (JSON Web Key)](https://tools.ietf.org/html/rfc7517) - describes format and handling of cryptographic keys in JOSE

## Features

- Token serialization
- Token deserialization
- Claims validation
    - `exp`, `iat`, `nbf` claims validatation - supported
    - `aud`, `iss`, `sub` claims validatation - planned
- Sign algorithms
    - `NONE`, `HS256`, `HS384`, `HS512` algorithms - supported
- Encryption algorithms
    - `RS256`, `RS384`, `RS512` algorithms - planned
    - `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512` algorithms - not (yet) planned
	- Not affected by the`None`algorithm vulnerability

This library is not susceptible to the [recently discussed encryption vulnerability](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/).

## Todo

##### Features
- Token validation: `aud`, `iss`, `sub`
- RSA algorithms implementation
- Creation of `TJWTClaims` derived classes

##### Code
- D2010+ porting
- Unit Tests
- More examples


## Prerequisite
This library is built with **Delphi XE8**, but with a minumum amount of work it will compile with **D2010 and higher**
#### Libraries/Units dependencies<commit_msg>inserted info about openssl dlls in README.md<commit_after># Delphi JOSE and JWT Library

[Delphi](http://www.embarcadero.com/products/delphi) implementation of JWT (JSON Web Token) and the JOSE (JSON Object Signing and Encryption) specification suite. This library supports the JWS (JWE is support planned) compact serializations with several JOSE algorithms.

![Image of Delphi-JOSE Demo](http://paolo-rossi.github.io/delphi-jose-jwt/images/jose-delphi.png)

## Important!
The HMAC algorithm uses OpenSSL through the Indy library, so in order to generate the token you should have the OpenSSL DLLs in your server system.
The client doesn't have to generate or verify the token (using HMAC) so on the client-side there's no need for the OpenSSL DLLs.
You can download the packages at the [fulgan website](https://indy.fulgan.com/SSL/) (keep in mind to always download the latest version)

## What is JOSE

[JOSE](https://tools.ietf.org/html/rfc7520) is a standard that provides a general approach to signing and encryption of any content. JOSE consists of several RFC:

- [JWT (JSON Web Token)](https://tools.ietf.org/html/rfc7519) - describes representation of claims encoded in JSON
- [JWS (JSON Web Signature)](https://tools.ietf.org/html/rfc7515) - describes producing and handling signed messages
- [JWE (JSON Web Encryption)](https://tools.ietf.org/html/rfc7516) - describes producing and handling encrypted messages
- [JWA (JSON Web Algorithms)](https://tools.ietf.org/html/rfc7518) - describes cryptographic algorithms used in JOSE
- [JWK (JSON Web Key)](https://tools.ietf.org/html/rfc7517) - describes format and handling of cryptographic keys in JOSE

## Features

- Token serialization
- Token deserialization
- Claims validation
    - `exp`, `iat`, `nbf` claims validatation - supported
    - `aud`, `iss`, `sub` claims validatation - planned
- Sign algorithms
    - `NONE`, `HS256`, `HS384`, `HS512` algorithms - supported
- Encryption algorithms
    - `RS256`, `RS384`, `RS512` algorithms - planned
    - `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512` algorithms - not (yet) planned
	- Not affected by the`None`algorithm vulnerability

This library is not susceptible to the [recently discussed encryption vulnerability](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/).

## Todo

##### Features
- Token validation: `aud`, `iss`, `sub`
- RSA algorithms implementation
- Creation of `TJWTClaims` derived classes

##### Code
- D2010+ porting
- Unit Tests
- More examples


## Prerequisite
This library is built with **Delphi XE8**, but with a minimum amount of work it will compile with **D2010 and higher**
#### Libraries/Units dependencies
{'fraction_non_alphanumeric': 0.11556365108277676, 'fraction_numerical': 0.031572556162720096, 'mean_word_length': 4.509476031215161, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 15, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '273927', 'n_tokens_mistral': 1598, 'n_tokens_neox': 1444, 'n_words': 525}