Creating a JSON Web Token (JWT)

Example using the Go programming language to generate the key pair:

package main
  
  import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "encoding/base64"
    "encoding/pem"
    "flag"
    "fmt"
    "io/ioutil"
    "os"
    "path"
    "strconv"
    "time"
  )
  
  func main() {
    var out string
  
    flag.StringVar(&out, "output-dir", "", "Output directory to write files into")
    flag.Parse()
  
    if out == "" {
      out = "rsa-key_" + strconv.FormatInt(time.Now().Unix(), 10)
    }
  
    if err := os.MkdirAll(out, os.ModePerm); err != nil {
      panic(err.Error())
    }
  
    priv, err := rsa.GenerateKey(rand.Reader, 2048)
    if err != nil {
      panic(err.Error())
    }
  
    privBytes := x509.MarshalPKCS1PrivateKey(priv)
  
    pubBytes, err := x509.MarshalPKIXPublicKey(priv.Public())
    if err != nil {
      panic(err.Error())
    }
  
    privOut, err := os.OpenFile(path.Join(out, "private.pem"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
    if err != nil {
      panic(err.Error())
    }
  
    if err := pem.Encode(privOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: privBytes}); err != nil {
      panic(err.Error())
    }
  
    pubOut, err := os.OpenFile(path.Join(out, "public.pem"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
    if err != nil {
      panic(err.Error())
    }
  
    if err := pem.Encode(pubOut, &pem.Block{Type: "PUBLIC KEY", Bytes: pubBytes}); err != nil {
      panic(err.Error())
    }
  
    var pubEnc = base64.StdEncoding.EncodeToString(pubBytes)
  
    var pubEncOut = path.Join(out, "public_key.txt")
    if err := ioutil.WriteFile(pubEncOut, []byte(pubEnc+"\n"), 0600); err != nil {
      panic(err.Error())
    }
  
    fmt.Println("Public key saved in " + pubEncOut)
  }
  

Example using node.js to generate the key pair:

var crypto = require("crypto");
  var fs = require("fs");
  
  var now = Math.floor(new Date() / 1000);
  var dir = "rsa-key_" + now;
  fs.mkdirSync(dir);
  
  crypto.generateKeyPair(
    "rsa",
    {modulusLength: 2048},
    (err, publicKey, privateKey) => {
      fs.writeFile(
        dir + "/public.pem",
        publicKey.export({ type: "spki", format: "pem" }),
        err => {}
      );
      fs.writeFile(
        dir + "/public_key.txt",
        publicKey.export({ type: "spki", format: "der" }).toString("base64") +
          "\n",
        err => {}
      );
      fs.writeFile(
        dir + "/private.pem",
        privateKey.export({ type: "pkcs1", format: "pem" }),
        err => {}
      );
    }
  );
  
  console.log("Public key saved in " + dir + "/public_key.txt");

Here is an example of a reference Go implementation (as a cli tool) for generating tokens without the use of any 3rd party library:

package main

import (
  "crypto"
  "crypto/ecdsa"
  "crypto/rand"
  "crypto/rsa"
  "crypto/sha256"
  "crypto/x509"
  "encoding/base64"
  "encoding/json"
  "encoding/pem"
  "flag"
  "fmt"
  "io/ioutil"
  "os"
  "strings"
  "time"
)

// Header is the base64UrlEncoded string of a JWT header for the RS256 algorithm
const RSAHeader = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9"

// Header is the base64UrlEncoded string of a JWT header for the EC256 algorithm
const ECHeader = "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9"

// Claims represents constraints that should be applied to the use of the token
type Claims struct {
  Iat   float64 `json:"iat,omitempty"`   // Issued At
  Exp   float64 `json:"exp,omitempty"`   // Expires At
  Accid string  `json:"accid,omitempty"` // Account ID
  Conid string  `json:"conid,omitempty"` // Content ID
  Maxu  float64 `json:"maxu,omitempty"`  // Max Uses
  Maxip float64 `json:"maxip,omitempty"` // Max IPs
  Ua    string  `json:"ua,omitempty"`    // User Agent
}

func main() {
  var key, algorithm string

  c := Claims{Iat: float64(time.Now().Unix())}

  flag.StringVar(&key, "key", "", "Path to private.pem key file")
  flag.StringVar(&c.Accid, "account-id", "", "Account ID")
  flag.StringVar(&c.Conid, "content-id", "", "Content ID (eg, video_id or live_job_id)")
  flag.Float64Var(&c.Exp, "expires-at", float64(time.Now().AddDate(0, 0, 1).Unix()), "Epoch timestamp (in seconds) for when the token should stop working")
  flag.Float64Var(&c.Maxu, "max-uses", 0, "Maximum number of times the token is valid for")
  flag.Float64Var(&c.Maxip, "max-ips", 0, "Maximum number of unique IP addresses the token is valid for")
  flag.StringVar(&c.Ua, "user-agent", "", "User Agent that the token is valid for")
  flag.StringVar(&algorithm, "algo", "", "Key algorithm to use for signing. Valid: ec256, rsa256")
  flag.Parse()

  if key == "" {
    fmt.Printf("missing required flag: -key\n\n")
    flag.Usage()
    os.Exit(1)
  }

  if algorithm == "" {
    fmt.Printf("missing required flag: -algo\n\n")
    flag.Usage()
    os.Exit(2)
  }

  if algorithm != "rsa256" && algorithm != "ec256" {
    fmt.Printf("missing valid value for -algo flag. Valid: rsa256, ec256\n\n")
    flag.Usage()
    os.Exit(3)
  }

  if c.Accid == "" {
    fmt.Printf("missing required flag: -account-id\n\n")
    flag.Usage()
    os.Exit(4)
  }

  bs, err := json.Marshal(c)
  if err != nil {
    fmt.Println("failed to marshal token to json", err)
    os.Exit(5)
  }

  kbs, err := ioutil.ReadFile(key)
  if err != nil {
    fmt.Println("failed to read private key", err)
    os.Exit(6)
  }

  if algorithm == "rsa256" {
    processRSA256(kbs, bs)
  } else {
    processEC256(kbs, bs)
  }
}

func processRSA256(kbs, bs []byte) {
  block, _ := pem.Decode(kbs)
  if block == nil {
    fmt.Println("failed to decode PEM block containing private key")
    os.Exit(7)
  }

  if block.Type != "RSA PRIVATE KEY" {
    fmt.Println("failed to decode PEM block containing private key")
    os.Exit(8)
  }

  pKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
  if err != nil {
    fmt.Println("failed to parse rsa private key", err)
    os.Exit(9)
  }

  message := RSAHeader + "." + base64.RawURLEncoding.EncodeToString(bs)

  hash := crypto.SHA256
  hasher := hash.New()
  _, _ = hasher.Write([]byte(message))
  hashed := hasher.Sum(nil)

  r, err := rsa.SignPKCS1v15(rand.Reader, pKey, hash, hashed)
  if err != nil {
    fmt.Println("failed to sign token", err)
    os.Exit(10)
  }

  sig := strings.TrimRight(base64.RawURLEncoding.EncodeToString(r), "=")

  fmt.Println(message + "." + sig)
}

func processEC256(kbs, bs []byte) {
  block, _ := pem.Decode(kbs)
  if block == nil {
    fmt.Println("failed to decode PEM block containing private key")
    os.Exit(7)
  }

  if block.Type != "EC PRIVATE KEY" {
    fmt.Println("failed to decode PEM block containing private key")
    os.Exit(8)
  }

  pkey, err := x509.ParseECPrivateKey(block.Bytes)
  if err != nil {
    fmt.Println("failed to parse ec private key", err)
    os.Exit(9)
  }

  message := ECHeader + "." + base64.RawURLEncoding.EncodeToString(bs)
  hash := sha256.Sum256([]byte(message))

  r, s, err := ecdsa.Sign(rand.Reader, pkey, hash[:])
  if err != nil {
    fmt.Println("failed to sign token", err)
    os.Exit(10)
  }

  curveBits := pkey.Curve.Params().BitSize

  keyBytes := curveBits / 8
  if curveBits%8 > 0 {
    keyBytes++
  }

  rBytes := r.Bytes()
  rBytesPadded := make([]byte, keyBytes)
  copy(rBytesPadded[keyBytes-len(rBytes):], rBytes)

  sBytes := s.Bytes()
  sBytesPadded := make([]byte, keyBytes)
  copy(sBytesPadded[keyBytes-len(sBytes):], sBytes)

  out := append(rBytesPadded, sBytesPadded...)

  sig := base64.RawURLEncoding.EncodeToString(out)
  fmt.Println(message + "." + sig)
}