CHANGELOG.md

@@ -4,6 +4,15 @@
 All notable changes to this project will be documented in this file starting from version **v4.0.0**.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 7.3.0 - 2017-02-13
+
+ - Add more information to `maxAge` option in README ([1b0592e99cc8def293eed177e2575fa7f1cf7aa5](https://github.com/auth0/node-jsonwebtoken/commit/1b0592e99cc8def293eed177e2575fa7f1cf7aa5))
+ - Add `clockTimestamp` option to `verify()` you can set the current time in seconds with it (#274) ([8fdc1504f4325e7003894ffea078da9cba5208d9](https://github.com/auth0/node-jsonwebtoken/commit/8fdc1504f4325e7003894ffea078da9cba5208d9))
+ - Fix handling non string tokens on `verify()` input (#305) ([1b6ec8d466504f58c5a6e2dae3360c828bad92fb](https://github.com/auth0/node-jsonwebtoken/commit/1b6ec8d466504f58c5a6e2dae3360c828bad92fb)), closes [#305](https://github.com/auth0/node-jsonwebtoken/issues/305)
+ - Fixed a simple typo in docs (#287) ([a54240384e24e18c00e75884295306db311d0cb7](https://github.com/auth0/node-jsonwebtoken/commit/a54240384e24e18c00e75884295306db311d0cb7)), closes [#287](https://github.com/auth0/node-jsonwebtoken/issues/287)
+ - Raise jws.decode error to avoid confusion with "invalid token" error  (#294) ([7f68fe06c88d5c5653785bd66bc68c5b20e1bd8e](https://github.com/auth0/node-jsonwebtoken/commit/7f68fe06c88d5c5653785bd66bc68c5b20e1bd8e))
+ - rauchg/ms.js changed to zeit/ms (#303) ([35d84152a6b716d757cb5b1dd3c79fe3a1bc0628](https://github.com/auth0/node-jsonwebtoken/commit/35d84152a6b716d757cb5b1dd3c79fe3a1bc0628))
+
 ## 7.2.1 - 2016-12-07
 
  - add nsp check to find vulnerabilities on npm test ([4219c34b5346811c07f520f10516cc495bcc70dd](https://github.com/auth0/node-jsonwebtoken/commit/4219c34b5346811c07f520f10516cc495bcc70dd))

README.md

@@ -15,7 +15,7 @@ $ npm install jsonwebtoken
 
 # Usage
 
-### jwt.sign(payload, secretOrPrivateKey, options, [callback])
+### jwt.sign(payload, secretOrPrivateKey, [options, callback])
 
 (Asynchronous) If a callback is supplied, callback is called with the `err` or the JWT.
 
@@ -42,6 +42,8 @@ If `payload` is not a buffer or a string, it will be coerced into a string using
 
 There are no default values for `expiresIn`, `notBefore`, `audience`, `subject`, `issuer`. These claims can also be provided in the payload directly with `exp`, `nbf`, `aud`, `sub` and `iss` respectively, but you can't include in both places.
 
+Remember that `exp`, `nbf` and `iat` are **NumericDate**, see related [Token Expiration (exp claim)](#token-expiration-exp-claim)
+
 
 The header can be customized via the `option.header` object.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsonwebtoken",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "description": "JSON Web Token implementation (symmetric and asymmetric)",
   "main": "index.js",
   "scripts": {

sign.js

@@ -43,7 +43,12 @@ var options_for_objects = [
 ];
 
 module.exports = function (payload, secretOrPrivateKey, options, callback) {
-  options = options || {};
+  if (typeof options === 'function') {
+    callback = options;
+    options = {};
+  } else {
+    options = options || {};
+  }
 
   var isObjectPayload = typeof payload === 'object' &&
                         !Buffer.isBuffer(payload);

test/async_sign.tests.js

@@ -18,13 +18,20 @@ describe('signing a token asynchronously', function() {
       });
     });
 
-    it('should work', function (done) {
+    it('should work with empty options', function (done) {
       jwt.sign({abc: 1}, "secret", {}, function (err, res) {
         expect(err).to.be.null();
         done();
       });
     });
 
+    it('should work without options object at all', function (done) {
+      jwt.sign({abc: 1}, "secret", function (err, res) {
+        expect(err).to.be.null();
+        done();
+      });
+    });
+
     it('should return error when secret is not a cert for RS256', function(done) {
       //this throw an error because the secret is not a cert and RS256 requires a cert.
       jwt.sign({ foo: 'bar' }, secret, { algorithm: 'RS256' }, function (err) {

test/jwt.hs.tests.js

@@ -15,7 +15,7 @@ describe('HS256', function() {
       expect(token.split('.')).to.have.length(3);
     });
 
-    it('should without options', function(done) {
+    it('should be able to validate without options', function(done) {
       var callback = function(err, decoded) {
         assert.ok(decoded.foo);
         assert.equal('bar', decoded.foo);
@@ -77,6 +77,13 @@ describe('HS256', function() {
         done();
       });
     });
+
+    it('should default to HS256 algorithm when no options are passed', function() {
+      var token = jwt.sign({ foo: 'bar' }, secret);
+      var verifiedToken = jwt.verify(token, secret);
+      assert.ok(verifiedToken.foo);
+      assert.equal('bar', verifiedToken.foo);
+    });
   });
 
   describe('should fail verification gracefully with trailing space in the jwt', function() {