Disallow Encode(payload) with AddClaim(s)

src/JWT/Builder/JwtBuilder.cs

@@ -1,8 +1,14 @@
-using System;
+using System;
 using System.Linq;
 using System.Reflection;
 using JWT.Algorithms;
 using JWT.Serializers;
+using Newtonsoft.Json;
+
+#if MODERN_DOTNET
+using System.Text.Json.Serialization;
+#endif
+
 using static JWT.Internal.EncodingHelper;
 
 namespace JWT.Builder
@@ -276,7 +282,7 @@ public string Encode(Type payloadType, object payload)
             EnsureCanEncode();
 
             var dic = payloadType.GetProperties(BindingFlags.Instance | BindingFlags.Public)
-                                 .ToDictionary(prop => prop.Name, prop => prop.GetValue(payload, null));
+                                 .ToDictionary(prop => GetPropName(prop), prop => prop.GetValue(payload, null));
 
             foreach (var pair in dic)
             {
@@ -320,6 +326,14 @@ public T DecodeHeader<T>(string token)
             return _decoder.DecodeHeader<T>(token);
         }
 
+        public object Decode(string token, Type type)
+        {
+            EnsureCanDecode();
+
+            return _decoder.DecodeToObject(type, token, _secrets, _valParams.ValidateSignature);
+        }
+
+
         /// <summary>
         /// Decodes a token using the supplied dependencies.
         /// </summary>
@@ -468,5 +482,42 @@ private bool CanDecodeHeader()
 
             return true;
         }
+
+        private string GetPropName(MemberInfo prop)
+        {
+            var jsonSerializer = _jsonSerializerFactory.Create();
+
+            var customAttributes = prop.GetCustomAttributes(inherit: true);
+            foreach (var attribute in customAttributes)
+            {
+                switch (jsonSerializer)
+                {
+                    case JsonNetSerializer:
+                    {
+                        if (attribute is JsonPropertyAttribute jsonNetProperty)
+                        {
+                            return jsonNetProperty.PropertyName;
+                        }
+                        break;
+                    }
+#if MODERN_DOTNET
+                    case SystemTextSerializer:
+                    {
+                        if (attribute is JsonPropertyNameAttribute stjProperty)
+                        {
+                            return stjProperty.Name;
+                        }
+                        break;
+                    }
+#endif
+                    default:
+                    {
+                        return prop.Name;
+                    }
+                }
+            }
+
+            return prop.Name;
+        }
     }
 }

src/JWT/JWT.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFrameworks>netstandard1.3;netstandard2.0;net6.0;net35;net40;net462;</TargetFrameworks>
@@ -20,7 +20,7 @@
     <Authors>Alexander Batishchev, John Sheehan, Michael Lehenbauer</Authors>
     <PackageTags>jwt;json;authorization</PackageTags>
     <PackageLicenseExpression>CC0-1.0</PackageLicenseExpression>
-    <Version>10.0.1</Version>
+    <Version>10.0.2-beta1</Version>
     <FileVersion>10.0.0.0</FileVersion>
     <AssemblyVersion>10.0.0.0</AssemblyVersion>
     <RootNamespace>JWT</RootNamespace>

tests/JWT.Tests.Common/Builder/JwtBuilderDecodeTests.cs

@@ -433,5 +433,116 @@ public void Decode_ToDictionary_Without_Serializer_Should_Throw_Exception()
             action.Should()
                   .Throw<ArgumentNullException>();
         }
+
+        [TestMethod]
+        public void Encode_Decode_ToJsonNetDecoratedType_Should_UseDecoratedName_Bug456()
+        {
+            var serializer = new JsonNetSerializer();
+            var alg = new NoneAlgorithm();
+
+            var token = JwtBuilder.Create()
+                                  .WithAlgorithm(alg)
+                                  .WithJsonSerializer(serializer);
+
+            var expected = new TestData.TestDataJsonNetDecorated
+            {
+                City = "Amsterdam",
+            };
+
+            var encoded = token.Encode(expected);
+            encoded.Should().NotBeNullOrEmpty();
+
+            token = JwtBuilder.Create()
+                              .WithAlgorithm(alg)
+                              .WithJsonSerializer(serializer);
+
+            var actual = token.Decode<TestData.TestDataJsonNetDecorated>(encoded);
+            actual.Should().BeEquivalentTo(expected);
+        }
+
+        [TestMethod]
+        public void Encode_Decode_Should_Return_Token_Nested_Data_ShouldRespectAttributes()
+        {
+            var serializer = new JsonNetSerializer();
+            var alg = new NoneAlgorithm();
+
+            var expected = new TestData.TestDataJsonNetDecorated
+            {
+                City = "Amsterdam",
+            };
+
+            var encoded = JwtBuilder.Create()
+                .WithAlgorithm(alg)
+                .WithJsonSerializer(serializer)
+                .AddClaim<TestData.TestDataJsonNetDecorated>("Data", expected)
+                .Encode();
+
+            encoded.Should().NotBeNullOrEmpty();
+            Console.WriteLine(encoded);
+            var jwtBuilder = JwtBuilder.Create()
+                                       .WithAlgorithm(alg)
+                .WithJsonSerializer(serializer)
+                .WithJsonSerializer(serializer);
+
+            var payloadType = new TestData.PayloadWithNestedJsonNetData
+            {
+                Data = default
+            };
+
+            var actual = (TestData.PayloadWithNestedJsonNetData)jwtBuilder.Decode(encoded, payloadType.GetType());
+            actual.Data.Should().BeEquivalentTo(expected);
+        }
+
+#if NETSTANDARD2_0 || NET6_0_OR_GREATER
+        [TestMethod]
+        public void Encode_Decode_ToSystemTextSerializerDecoratedType_Should_UseDecoratedName_Bug456()
+        {
+            var serializer = new SystemTextSerializer();
+            var alg = new NoneAlgorithm();
+
+            var expected = new TestData.TestDataSystemTextSerializerDecorated
+            {
+                City = "Amsterdam",
+            };
+
+            var encoded = JwtBuilder.Create()
+                                    .WithAlgorithm(alg)
+                                    .WithJsonSerializer(serializer)
+                                   .Encode(expected);
+            encoded.Should().NotBeNullOrEmpty();
+
+            var actual = JwtBuilder.Create()
+                                   .WithAlgorithm(alg)
+                                   .WithJsonSerializer(serializer)
+                                   .Decode<TestData.TestDataSystemTextSerializerDecorated>(encoded);
+            actual.Should().BeEquivalentTo(expected);
+        }
+
+        [TestMethod]
+        public void Encode_Decode_Should_Return_Token_Nested_Data_ShouldRespectAttributes_SystemTextSerializer()
+        {
+            var serializer = new SystemTextSerializer();
+            var alg = new NoneAlgorithm();
+
+            var expected = new TestData.TestDataSystemTextSerializerDecorated
+            {
+                City = "Amsterdam",
+            };
+
+            var encoded = JwtBuilder.Create()
+                                    .WithAlgorithm(alg)
+                                    .WithJsonSerializer(serializer)
+                                    .AddClaim<TestData.TestDataSystemTextSerializerDecorated>("Data", expected)
+                                    .Encode();
+            encoded.Should().NotBeNullOrEmpty();
+
+            var actual = JwtBuilder.Create()
+                                   .WithAlgorithm(alg)
+                                   .WithJsonSerializer(serializer)
+                                   .WithJsonSerializer(serializer)
+                                   .Decode<TestData.PayloadWithNestedSystemTextSerializerData>(encoded);
+            actual.Data.Should().BeEquivalentTo(expected);
+        }
+#endif
     }
 }

tests/JWT.Tests.Common/Builder/JwtBuilderEncodeTests.cs

@@ -382,6 +382,35 @@ public void Encode_With_Secret_Should_Return_Valid_Token_Using_Json_Net()
         }
 
 #if NETSTANDARD2_0 || NET6_0_OR_GREATER
+
+        [TestMethod]
+        public void Encode_Should_Return_Token_With_Custom_Extra_Headers_Full_Payload_SystemTextSerializer()
+        {
+            var serializer = new SystemTextSerializer();
+
+            const string key = TestData.Secret;
+
+            var token = JwtBuilder.Create()
+                                  .WithAlgorithm(TestData.HMACSHA256Algorithm)
+                                  .WithSecret(key)
+                                  .WithJsonSerializer(serializer)
+                                  .AddHeader("version", 1)
+                                  .Encode(
+                                      new
+                                      {
+                                          ExtraClaim = new
+                                          {
+                                              NestedProperty1 = "Foo",
+                                              NestedProperty2 = 3
+                                          },
+                                          FirstName = "Jesus",
+                                          Age = 33
+                                      });
+
+            token.Should()
+                 .Be(TestData.TokenWithCustomTypeHeader3AndClaimNested, "because the same data encoded with the same key must result in the same token");
+        }
+
         [TestMethod]
         public void Encode_Test_Bug438()
         {

tests/JWT.Tests.Common/Models/TestData.cs

@@ -3,7 +3,7 @@
 using System.Security.Cryptography.X509Certificates;
 using JWT.Algorithms;
 
-#if NETSTANDARD2_1 || NET6_0
+#if NETSTANDARD2_1 || NET6_0_OR_GREATER
 using System.Security.Cryptography;
 #endif
 
@@ -17,6 +17,30 @@ public static class TestData
             Age = 33
         };
 
+        public class PayloadWithNestedJsonNetData
+        {
+            public TestDataJsonNetDecorated Data { get; set; }
+        }
+
+        public class TestDataJsonNetDecorated
+        {
+            [Newtonsoft.Json.JsonProperty("AT")]
+            public string City { get; set; }
+        }
+
+#if NETSTANDARD2_0 || NET6_0
+        public class PayloadWithNestedSystemTextSerializerData
+        {
+            public TestDataSystemTextSerializerDecorated Data { get; set; }
+        }
+
+        public class TestDataSystemTextSerializerDecorated
+        {
+            [System.Text.Json.Serialization.JsonPropertyName("AT")]
+            public string City { get; set; }
+        }
+#endif
+
         public const string Secret = "GQDstcKsx0NHjPOuXOYg5MbeJ1XT0uFiwDVvVBrk";
         public const string Secret2 = "QWORIJkmQWEDIHbjhOIHAUSDFOYnUGWEYT";
 
@@ -68,7 +92,7 @@ public static class TestData
         public static readonly X509Certificate2 CertificateWithPublicKeyEcdsa = new X509Certificate2(
             Convert.FromBase64String(ServerPublicKeyEcdsa));
 
-#if NETSTANDARD2_1 || NET6_0
+#if NETSTANDARD2_1 || NET6_0_OR_GREATER
         public static readonly X509Certificate2 CertificateWithPrivateKey = CreateCertificate();
 
         private static X509Certificate2 CreateCertificate()
@@ -83,4 +107,4 @@ private static X509Certificate2 CreateCertificate()
         }
 #endif
     }
-}
+}