🌟 [Major]: JWT v2 overhaul delivers a new typed, standards-aligned interface#26
Draft
Marius Storhaug (MariusStorhaug) wants to merge 25 commits into
Draft
🌟 [Major]: JWT v2 overhaul delivers a new typed, standards-aligned interface#26Marius Storhaug (MariusStorhaug) wants to merge 25 commits into
Marius Storhaug (MariusStorhaug) wants to merge 25 commits into
Conversation
…t, Get-Jwt*, JwtKey converters
…JWK round-trip, and algorithm-confusion coverage
… claim handling on PowerShell
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
added
the
Major
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNPOWERSHELL |
…WS surface with curve-OID enforcement
Marius Storhaug (MariusStorhaug)
changed the title
This was referenced May 12, 2026
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNNATURAL_LANGUAGEPOWERSHELL |
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNNATURAL_LANGUAGEPOWERSHELL |
…, add Base64Url tests - README.md: Fix MD060 table column alignment; correct 'end to end' to 'end-to-end' - JwtPayload.ps1: Extract $autoNull variable to shorten lines below 150 chars - New-Jwt.ps1: Break long if-condition into parenthesized $shouldDispose expression - Test-Jwt.ps1: Extract $supportedAlgs array; use $allowed for dynamic error message; break long lines and fix finally-block indentation - New-JwtHmac.ps1: Suppress PSUseShouldProcessForStateChangingFunctions, PSUseOutputTypeCorrectly - Resolve-JwtKey.ps1, Test-JwtClaim.ps1, ConvertFrom-Base64UrlString.ps1, ConvertFrom-JwtKey.ps1, Get-JwtClaim.ps1: Suppress PSUseOutputTypeCorrectly (polymorphic return types) - Jwt.Tests.ps1: Suppress PSAvoidUsingConvertToSecureStringWithPlainText and PSAvoidLongLines; add Base64Url helper tests (ConvertFrom-Base64UrlString coverage)
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNPOWERSHELL |
…Found false positives
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNPOWERSHELL |
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
changed the title
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter POWERSHELL |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jwt v2 is a full overhaul of token creation, parsing, validation, and key handling. The user-facing interface is now type-first, standards-aligned, and designed for safer default behavior and clearer composition in automation.
Breaking Changes
The v1 JWT surface has been replaced by the v2 typed interface.
Existing integrations that depended on legacy command signatures or output shapes must migrate to the v2 command contracts.
Generated-key bundle output from
New-Jwtwas removed in favor of a stable[Jwt]return shape; key ownership/export should useNew-JwtSigningKey.New: Typed, composable JWT object model
Commands now center on typed objects (
[Jwt],[JwtHeader],[JwtPayload],[JwtKey],[JwtKeySet]) so callers can work directly with structured data instead of string-only flows.This includes stable formatting/type metadata for better terminal output and safer default key display behavior.
Changed: Safer JOSE/JWT validation behavior
Test-Jwtnow enforces JOSE critical-header (crit) semantics when present.Tokens declaring
critrequire explicit allow-listing via-AllowedCriticalHeaderand fail closed on unsupported or malformed critical declarations.No
critheader is required for normal validation flows.Changed: Clearer key-conversion behavior
ConvertFrom-JwtKeynow returns rawbyte[]forkty=octby default.When an HMAC instance is needed, callers can explicitly request it with
-AsHmac -Algorithm HS256|HS384|HS512.Changed: CI/release safety alignment
Process-PSModule workflow secret forwarding now uses explicit secret mapping instead of
secrets: inherit.Technical Details
critenforcement inTest-Jwtand addedCriticalHeadersto-Detailedchecks.New-Jwtoutput contract to[Jwt]across parameter sets.New-JwtSigningKeyand aligned examples/docs around explicit key ownership.GenerateKeyusage) and UTF-8 BOM normalization on edited PowerShell files.113tests passed).Related issues