Data

Tools

Indexes

Applications

Experiments

Ruby

A summary of data about the Ruby ecosystem.

Recent Releases of https://github.com/jwt/ruby-jwt

https://github.com/jwt/ruby-jwt - jwt-2.10.2

v2.10.2 (2025-06-29)

Full Changelog

Fixes and enhancements:

  • Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697

- Ruby
Published by anakinj 8 months ago

https://github.com/jwt/ruby-jwt - jwt-3.1.2

v3.1.2 (2025-06-28)

Full Changelog

Fixes and enhancements:

  • Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697
  • Fix signing with a EC JWK #699 (@anakinj)

- Ruby
Published by anakinj 8 months ago

https://github.com/jwt/ruby-jwt - jwt-3.1.1

v3.1.1 (2025-06-24)

Full Changelog

Fixes and enhancements:

  • Require the algorithm to be provided when signing and verifying tokens using JWKs #695 (@anakinj)

- Ruby
Published by anakinj 8 months ago

https://github.com/jwt/ruby-jwt - jwt-3.1.0

v3.1.0 (2025-06-23)

Full Changelog

Features:

  • Add support for x5t header parameter for X.509 certificate thumbprint verification #669 (@hieuk09)
  • Raise an error if the ECDSA signing or verification key is not an instance of OpenSSL::PKey::EC #688 (@anakinj)
  • Allow OpenSSL::PKey::EC::Point to be used as the verification key in ECDSA #689 (@anakinj)
  • Require claims to have been verified before accessing the JWT::EncodedToken#payload #690 (@anakinj)
  • Support signing and verifying tokens using a JWK #692 (@anakinj)

- Ruby
Published by anakinj 8 months ago

https://github.com/jwt/ruby-jwt - jwt-3.0.0

v3.0.0 (2025-06-14)

Full Changelog

Breaking changes:

  • Require token signature to be verified before accessing payload #648 (@anakinj)
  • Drop support for the HS512256 algorithm #650 (@anakinj)
  • Remove deprecated claim verification methods #654 (@anakinj)
  • Remove dependency to rbnacl #655 (@anakinj)
  • Support only stricter base64 decoding (RFC 4648) #658 (@anakinj)
  • Custom algorithms are required to include JWT::JWA::SigningAlgorithm #660 (@anakinj)
  • Require RSA keys to be at least 2048 bits #661 (@anakinj)
  • Base64 encode and decode the k value for HMAC JWKs #662 (@anakinj)

Take a look at the upgrade guide for more details.

Features:

  • JWT::EncodedToken#verify! method that bundles signature and claim validation #647 (@anakinj)
  • Do not override the alg header if already given #659 (@anakinj)
  • Make JWK::KeyFinder compatible with JWT::EncodedToken #663 (@anakinj)

Fixes and enhancements:

- Ruby
Published by anakinj 9 months ago

https://github.com/jwt/ruby-jwt - jwt-3.0.0.beta1

v3.0.0-beta1 (2025-01-25)

Full Changelog

Breaking changes:

  • Require token signature to be verified before accessing payload #648 (@anakinj)
  • Drop support for the HS512256 algorithm #650 (@anakinj)
  • Remove deprecated claim verification methods #654 (@anakinj)
  • Remove dependency to rbnacl #655 (@anakinj)
  • Support only stricter base64 decoding (RFC 4648) #658 (@anakinj)
  • Custom algorithms are required to include JWT::JWA::SigningAlgorithm #660 (@anakinj)
  • Require RSA keys to be at least 2048 bits #661 (@anakinj)
  • Base64 encode and decode the k value for HMAC JWKs #662 (@anakinj)

Take a look at the upgrade guide for more details.

Features:

  • JWT::EncodedToken#verify! method that bundles signature and claim validation #647 (@anakinj)
  • Do not override the alg header if already given #659 (@anakinj)
  • Make JWK::KeyFinder compatible with JWT::EncodedToken #663 (@anakinj)

Fixes and enhancements:

- Ruby
Published by anakinj about 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.10.1

v2.10.1 (2024-12-26)

Full Changelog

Fixes and enhancements:

- Ruby
Published by anakinj about 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.10.0

v2.10.0 (2024-12-25)

Full Changelog

Features:

  • JWT::Token and JWT::EncodedToken for signing and verifying tokens #621 (@anakinj)
  • Detached payload support for JWT::Token and JWT::EncodedToken #630 (@anakinj)
  • Skip decoding payload if b64 header is present and false #631 (@anakinj)
  • Remove a few custom Rubocop configs #638 (@anakinj)

Fixes and enhancements:

  • Deprecation warnings for deprecated methods and classes #629 (@anakinj)
  • Improved documentation for public apis #629 (@anakinj)
  • Use correct methods when raising error during signing/verification with EdDSA #633
  • Fix JWT::EncodedToken behavior with empty string as token #640 (@ragalie)
  • Deprecation warnings for rbnacl backed functionality #641 (@anakinj)

- Ruby
Published by anakinj about 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.9.3

v2.9.3 (2024-10-03)

Full Changelog

Fixes and enhancements:

  • Return truthy value for ::JWT::ClaimsValidator#validate! and ::JWT::Verify.verify_claims #628 (@anakinj)

- Ruby
Published by anakinj over 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.9.2

v2.9.2 (2024-10-03)

Full Changelog

Features:

Fixes and enhancements:

  • Updated README to correctly document OpenSSL::HMAC documentation #617 (@aedryan)
  • Verify JWT header format #622 (@304)
  • Bring back ::JWT::ClaimsValidator, ::JWT::Verify and a few other removed interfaces for preserved backwards compatibility #624 (@anakinj)

- Ruby
Published by anakinj over 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.9.1

Full Changelog

Fixes and enhancements:

  • Fix regression in iss and aud claim validation #619 (@anakinj)

- Ruby
Published by anakinj over 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.9.0

Full Changelog

Features:

Fixes and enhancements:

- Ruby
Published by anakinj over 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.8.2

Full Changelog

Fixes and enhancements:

- Ruby
Published by anakinj over 1 year ago

https://github.com/jwt/ruby-jwt - jwt-2.8.1

Full Changelog

Features:

Fixes and enhancements:

- Ruby
Published by anakinj about 2 years ago

https://github.com/jwt/ruby-jwt - jwt-2.8.0

Full Changelog

Features:

  • Updated rubocop to 1.56 #573 (@anakinj)
  • Run CI on Ruby 3.3 #577 (@anakinj)
  • Deprecation warning added for the HMAC algorithm HS512256 (HMAC-SHA-512 truncated to 256-bits) #575 (@anakinj)
  • Stop using RbNaCl for standard HMAC algorithms #575 (@anakinj)

Fixes and enhancements:

  • Fix signature has expired error if payload is a string #555 (@GobinathAL)
  • Fix key base equality and spaceship operators #569 (@magneland)
  • Remove explicit base64 require from x5c_key_finder #580 (@anakinj)
  • Performance improvements and cleanup of tests #581 (@anakinj)
  • Repair EC x/y coordinates when importing JWK #585 (@julik)
  • Explicit dependency to the base64 gem #582 (@anakinj)
  • Deprecation warning for decoding content not compliant with RFC 4648 #582 (@anakinj)
  • Algorithms moved under the ::JWT::JWA module (@anakinj)

- Ruby
Published by anakinj about 2 years ago

https://github.com/jwt/ruby-jwt - jwt-2.7.1

Full Changelog

Fixes and enhancements:

- Ruby
Published by anakinj over 2 years ago

https://github.com/jwt/ruby-jwt - jwt-2.7.0

Full Changelog

Features:

Fixes and enhancements:

  • Fix issue with multiple keys returned by keyfinder and multiple allowed algorithms #545 (@mpospelov)
  • Non-string kid header values are now rejected #543 (@bellebaum)

- Ruby
Published by anakinj about 3 years ago

https://github.com/jwt/ruby-jwt - jwt-2.6.0

v2.6.0 (2022-12-22)

Full Changelog

Features:

Fixes and enhancements:

  • Raise descriptive error on empty hmac_secret and OpenSSL 3.0/openssl gem <3.0.1 #530 (@jonmchan).

- Ruby
Published by anakinj about 3 years ago

https://github.com/jwt/ruby-jwt - jwt-2.5.0

Full Changelog

Features:

Fixes and enhancements:

  • Bring back the old Base64 (RFC2045) deocode mechanisms #488 (@anakinj).
  • Rescue RbNaCl exception for EdDSA wrong key #491 (@n-studio).
  • New parameter name for cases when kid is not found using JWK key loader proc #501 (@anakinj).
  • Fix NoMethodError when a 2 segment token is missing 'alg' header #502 (@cmrd-senya).
  • Support OpenSSL >= 3.0 #496 (@anakinj).

- Ruby
Published by excpt over 3 years ago

https://github.com/jwt/ruby-jwt - jwt-2.4.1

v2.4.1 (2022-06-07)

Fixes and enhancements:

Full Changelog

- Ruby
Published by excpt over 3 years ago

https://github.com/jwt/ruby-jwt - jwt-2.4.0

v2.4.0 (2022-06-06)

Full Changelog

Features:

Fixes and enhancements:

- Ruby
Published by excpt over 3 years ago

https://github.com/jwt/ruby-jwt - jwt-2.4.0.beta1

v2.4.0 (2022-05-03)

Full Changelog

Implemented enhancements:

  • Ensure presence of claims #244
  • Support verifying signature signed using x5c header #59
  • Add x5c header key finder #338 (bdewater)

Security fixes:

  • Importing JWK then exporting results in different kid #313

Closed issues:

  • Is there a way to decode a ES256 encoded JWT with a root certificate but without a public key or a private key? #471
  • Encode output with extra quote #469
  • Please release new gem version #444
  • HS512 signature verification fails for valid tokens #438
  • ArgumentError: invalid base64 while calling JWT::JWK.import(hash) #361
  • NoMethodError (undefined method `encode' for JsonWebToken:Module) #329

Merged pull requests:

- Ruby
Published by excpt almost 4 years ago

https://github.com/jwt/ruby-jwt - jwt-2.3.0

v2.3.0 (2021-10-03)

Full Changelog

Closed issues:

  • [SECURITY] Algorithm Confusion Through kid Header #440
  • JWT to memory #436
  • ArgumentError: wrong number of arguments (given 2, expected 1) #429
  • HMAC section of README outdated #421
  • NoMethodError: undefined method `zero?' for nil:NilClass if JWT has no 'alg' field #410
  • Release new version #409
  • NameError: uninitialized constant JWT::JWK #403

Merged pull requests:

- Ruby
Published by excpt over 4 years ago

https://github.com/jwt/ruby-jwt - jwt-2.2.3

v2.2.3 (2021-04-19)

Full Changelog

Implemented enhancements:

  • Verify algorithm before evaluating keyfinder #343
  • Why jwt depends on json < 2.0 ? #179
  • Support for JWK in-lieu of rsa_public #158
  • Fix rspec raise_error warning #413 (excpt)
  • Add support for JWKs with HMAC key type. #372 (phlegx)
  • Improve 'none' algorithm handling #365 (danleyden)
  • Handle parsed JSON JWKS input with string keys #348 (martinemde)
  • Allow Numeric values during encoding #327 (fanfilmu)

Closed issues:

  • "Signature verification raised", yet jwt.io says "Signature Verified" #401
  • truffleruby-head build is failing #396
  • JWT::JWK::EC needs require 'forwardable' #392
  • How to use a 'signing key' as used by next-auth #389
  • undefined method `verify' for nil:NilClass when validate a JWT with JWK #383
  • Make specifying "algorithm" optional on decode #380
  • ADFS created access tokens can't be validated due to missing 'kid' header #370
  • new version? #355
  • JWT gitlab OmniAuth provider setup support #354
  • Release with support for RSA.import for ruby < 2.4 hasn't been released #347
  • cannot load such file -- jwt #339

Merged pull requests:

- Ruby
Published by excpt almost 5 years ago

https://github.com/jwt/ruby-jwt - jwt-2.2.2

v2.2.2 (2020-08-18)

Full Changelog

Implemented enhancements:

  • JWK does not decode. #332
  • Inconsistent use of symbol and string keys in args (exp and alrogithm). #331
  • Pin simplecov to < 0.18 #356 (anakinj)
  • verifies algorithm before evaluating keyfinder #346 (jb08)
  • Update Rails 6 appraisal to use actual release version #336 (smudge)
  • Update Travis #326 (berkos)
  • Improvement/encode hmac without key #312 (JotaSe)

Fixed bugs:

  • v2.2.1 warning: already initialized constant JWT Error #335
  • 2.2.1 is no longer raising JWT::DecodeError on nil verification key #328
  • Fix algorithm picking from decode options #359 (excpt)
  • Raise error when verification key is empty #358 (anakinj)

Closed issues:

  • JWT RSA: is it possible to encrypt using the public key? #366
  • Example unsigned token that bypasses verification #364
  • Verify exp claim/field even if it's not present #363
  • Decode any token #360
  • [question] example of using a pub/priv keys for signing? #351
  • JWT::ExpiredSignature raised for non-JSON payloads #350
  • verify_aud only verifies that at least one aud is expected #345
  • Sinatra 4.90s TTFB #344
  • How to Logout #342
  • jwt token decoding even when wrong token is provided for some letters #337
  • Need to use symbolize\_keys everywhere! #330
  • eval() used in Forwardable limits usage in iOS App Store #324
  • HS512256 OpenSSL Exception: First num too large #322
  • Can we change the separator character? #321
  • Verifying iat without leeway may break with poorly synced clocks #319
  • Adding support for 'hd' hosted domain string #314
  • There is no "typ" header in version 2.0.0 #233

Merged pull requests:

- Ruby
Published by excpt over 5 years ago

https://github.com/jwt/ruby-jwt - jwt-2.2.1

v2.2.1 (2019-05-24)

Full Changelog

Fixed bugs:

  • need to require 'forwardable' to use Forwardable #316
  • Add forwardable dependency for JWK RSA KeyFinder #317 (excpt)

- Ruby
Published by excpt almost 7 years ago

https://github.com/jwt/ruby-jwt - jwt-2.2.0

v2.2.0 (2019-03-20)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Inconsistent handling of payload claim data types #282
  • Use iat\_leeway option #273
  • Issued at validation #247
  • Fix bug and simplify segment validation #292 (anakinj)
  • Removed leeway from verify\_iat #257 (ab320012)

Closed issues:

  • RS256, public and private keys #291
  • Allow passing current time to decode #288
  • Verify exp claim without verifying jwt #281
  • Decoding JWT with ES256 and secp256k1 curve #277
  • Audience as an array - how to specify? #276
  • signature validation using decode method for JWT #271
  • JWT is easily breakable #267
  • Ruby JWT Token #265
  • ECDSA supported algorithms constant is defined as a string, not an array #264
  • NoMethodError: undefined method `group' for <xxxxx> #261
  • 'DecodeError'will replace 'ExpiredSignature' #260
  • TypeError: no implicit conversion of OpenSSL::PKey::RSA into String #259
  • NameError: uninitialized constant JWT::Algos::Eddsa::RbNaCl #258
  • Get new token if curren token expired #256
  • Infer algorithm from header #254
  • Why is the result of decode is an array? #252
  • Add support for headless token #251
  • Leeway or exp_leeway #215
  • Could you describe purpose of cert fixtures and their cryptokey lengths. #185

Merged pull requests:

- Ruby
Published by excpt almost 7 years ago

https://github.com/jwt/ruby-jwt - jwt-2.2.0-beta.0

2.2.0-beta.0 (2019-03-20)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • Inconsistent handling of payload claim data types #282
  • Use iat\_leeway option #273
  • Issued at validation #247
  • Fix bug and simplify segment validation #292 (anakinj)
  • Removed leeway from verify\_iat #257 (ab320012)

Closed issues:

  • RS256, public and private keys #291
  • Allow passing current time to decode #288
  • Verify exp claim without verifying jwt #281
  • Decoding JWT with ES256 and secp256k1 curve #277
  • Audience as an array - how to specify? #276
  • signature validation using decode method for JWT #271
  • JWT is easily breakable #267
  • Ruby JWT Token #265
  • ECDSA supported algorithms constant is defined as a string, not an array #264
  • NoMethodError: undefined method `group' for <xxxxx> #261
  • 'DecodeError'will replace 'ExpiredSignature' #260
  • TypeError: no implicit conversion of OpenSSL::PKey::RSA into String #259
  • NameError: uninitialized constant JWT::Algos::Eddsa::RbNaCl #258
  • Get new token if curren token expired #256
  • Infer algorithm from header #254
  • Why is the result of decode is an array? #252
  • Add support for headless token #251
  • Leeway or exp_leeway #215
  • Could you describe purpose of cert fixtures and their cryptokey lengths. #185

Merged pull requests:

- Ruby
Published by excpt almost 7 years ago

https://github.com/jwt/ruby-jwt - jwt-2.1.0

2.1.0 (2017-10-06)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • JWT.encode failing on encode for string #235
  • The README says it uses an algorithm by default #226
  • Fix string payload issue #236 (excpt)

Closed issues:

  • Change from 1.5.6 to 2.0.0 and appears a "Completed 401 Unauthorized" #240
  • Why doesn't the decode function use a default algorithm? #227

Merged pull requests:

- Ruby
Published by excpt over 8 years ago

https://github.com/jwt/ruby-jwt - jwt-2.0.0.beta1

Changelog

v2.0.0.beta1 (2017-02-27)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • ruby-jwt::raw_to_asn1: Fails for signatures less than byte_size #155
  • The leeway parameter is applies to all time based verifications #129
  • Add options for claim-specific leeway #187 (EmilioCristalli)
  • Make algorithm option required to verify signature #184 (EmilioCristalli)
  • Validate audience when payload is a scalar and options is an array #183 (steti)

Closed issues:

  • Different encoded value between servers with same password #197
  • Signature is different at each run #190
  • Include custom headers with password #189
  • can't create token - 'NotImplementedError: Unsupported signing method' #186
  • Why jwt depends on json < 2.0 ? #179
  • Cannot verify JWT at all?? #177
  • verify_iss: true is raising JWT::DecodeError instead of JWT::InvalidIssuerError #170

Merged pull requests:

- Ruby
Published by excpt over 8 years ago

https://github.com/jwt/ruby-jwt - jwt-2.0.0

Change Log

v2.0.0 (2017-09-03)

Full Changelog

Fixed bugs:

  • Support versions outside 2.1 #209
  • Verifying expiration without leeway throws exception #206
  • Ruby interpreter warning #200
  • TypeError: no implicit conversion of String into Integer #188
  • Fix JWT.encode(nil) #203 (tmm1)

Closed issues:

  • Possibility to disable claim verifications #222
  • Proper way to verify Firebase id tokens #216

Merged pull requests:

- Ruby
Published by excpt over 8 years ago

https://github.com/jwt/ruby-jwt - jwt-1.5.6

Full Changelog

Fixed bugs:

  • Fix missing symbol handling in aud verify code #166 (excpt)

Merged pull requests:

- Ruby
Published by excpt over 9 years ago

https://github.com/jwt/ruby-jwt - jwt-1.5.5

Full Changelog

Implemented enhancements:

  • JWT.decode always raises JWT::ExpiredSignature for tokens created with Time objects passed as the exp parameter #148

Fixed bugs:

  • expiration check does not give "Signature has expired" error for the exact time of expiration #157
  • JTI claim broken? #152
  • Audience Claim broken? #151
  • 1.5.3 breaks compatibility with 1.5.2 #133
  • Version 1.5.3 breaks 1.9.3 compatibility, but not documented as such #132
  • Fix: exp claim check #161 (excpt)

Closed issues:

  • Rendering Json Results in JWT::DecodeError #162
  • PHP Libraries #154
  • [security] Signature verified after expiration/sub/iss checks #153
  • Is ruby-jwt thread-safe? #150
  • JWT 1.5.3 #143
  • gem install v 1.5.3 returns error #141
  • Adding a CHANGELOG #140

Merged pull requests:

- Ruby
Published by excpt over 9 years ago

https://github.com/jwt/ruby-jwt - jwt-1.5.4

Full Changelog

Closed issues:

Merged pull requests:

  • Update README.md #138 (excpt)
  • Fix base64url_decode #136 (excpt)
  • Fix ruby 1.9.3 compatibility #135 (excpt)
  • iat can be a float value #134 (llimllib)

- Ruby
Published by excpt over 9 years ago

https://github.com/jwt/ruby-jwt - [YANKED] jwt-1.5.3

Changelog

  • Dropped ruby 1.9.3 support #131
  • Update README.md - improve documentation and fix typos
  • Removed echoe dependency
  • Fix hash/string key issue in options #130
  • Allow a proc to be passed for JTI verification #126
  • Code refactoring and code smell fixes

Commits

4a0b939 Merge pull request #131 from jwt/drop-ruby-1.9.3-support
cfc8362 Update .travis.yml
04120f6 Merge pull request #130 from tpickett66/hash-keys
a4d0473 Bump version
a6d1a33 Allow verification option keys to be strings or symbols
b47ab94 Make Verify an instantiatable class
6a9b5cc Adjust aud checking to use a string key against the payload
7b80ec9 Move Verify specs to a separate file.
2c7837f update testing and install sections of readme
d4fca40 Merge pull request #126 from yahooguntu/master
0100ad6 Allow a proc to be passed for JTI verification
b85b30e Merge pull request #122 from excpt/refactor-json-dependency
1499b16 Merge pull request #123 from excpt/ci-settings
2d5bc86 Remove obsolete json code
a03fbaf Add ruby 2.3.0 for travis ci testing
91b4220 Update README.md
86f470b Merge pull request #118 from excpt/master
a6672da Add fancy badges to README.md
0a2fa6c Merge pull request #117 from excpt/master
707376a Fix merge options bug
f889e49 Fix some code smells
a0815ee Fix some more code smells
e556eb9 Fix some code smells in JWT::Verify class
7a7ac9a Refactor decode and verify functionality
59dd2e0 Merge pull request #116 from excpt/master
79cdce8 Fix code smell reported by rubocop
451d950 Fix code smells reported by rubocop
4d440dc Fix travis test command
279df0e Remove echoe dependency
4f45b66 Add version class, remove utf8 encoding comment
559a23b Update codeclimate settings
cabde34 Merge pull request #114 from FXFusion/master
e5a94db Updated readme for iss/aud options
6c84213 Merge pull request #113 from lwe/lwe-jti-validation-fix
320306b relax restrictions on "jti" claim verification
27c7412 Merge pull request #112 from kat3kasper/fix/misspelling
02cbbd6 Fix error misspelling

- Ruby
Published by excpt about 10 years ago

https://github.com/jwt/ruby-jwt -

  • drop active ruby 1.8.x and <= 1.9.2 support
  • allow nbf to have exact time matches
  • iat now recognizes leeway
  • ensure that the sub claim check behaves like the aud claim check
  • test suite refactored
  • documentation updates

- Ruby
Published by excpt over 10 years ago