From 4d6ef155e12119f0b341d9fbca53a8a416dc939a Mon Sep 17 00:00:00 2001
From: Yuuki Furuyama <addsict@gmail.com>
Date: Fri, 14 Nov 2014 14:25:11 +0900
Subject: [PATCH] Use canonical json encoding

---
 lib/JSON/WebToken.pm                                  | 11 ++++++++---
 ...t-ietf-jose-json-web-signature-08-A1.hmac_sha256.t |  2 +-
 ...ft-ietf-jose-json-web-signature-08-A2.rsa_sha256.t |  2 +-
 .../draft-ietf-oauth-json-web-token-06-3.1.example.t  |  2 +-
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/lib/JSON/WebToken.pm b/lib/JSON/WebToken.pm
index 426d777..a10ef52 100644
--- a/lib/JSON/WebToken.pm
+++ b/lib/JSON/WebToken.pm
@@ -9,7 +9,7 @@ our $VERSION = '0.08';
 use parent 'Exporter';
 
 use Carp qw(croak);
-use JSON qw(encode_json decode_json);
+use JSON qw(decode_json);
 use MIME::Base64 qw(encode_base64 decode_base64);
 use Module::Runtime qw(use_module);
 
@@ -80,8 +80,8 @@ sub encode {
         );
     }
 
-    my $header_segment  = encode_base64url(encode_json $header);
-    my $claims_segment  = encode_base64url(encode_json $claims);
+    my $header_segment  = encode_base64url(_encode_json($header));
+    my $claims_segment  = encode_base64url(_encode_json($claims));
     my $signature_input = join '.', $header_segment, $claims_segment;
 
     my $signature = $class->_sign($algorithm, $signature_input, $secret);
@@ -94,6 +94,11 @@ sub encode_jwt {
     __PACKAGE__->encode(@_);
 }
 
+my $JSON; # cache
+sub _encode_json {
+    return ($JSON ||= JSON->new->utf8->canonical)->encode($_[0]);
+}
+
 sub decode {
     my ($class, $jwt, $secret, $is_verify) = @_;
     unless (defined $jwt) {
diff --git a/t/spec/draft-ietf-jose-json-web-signature-08-A1.hmac_sha256.t b/t/spec/draft-ietf-jose-json-web-signature-08-A1.hmac_sha256.t
index 9243d93..625e533 100644
--- a/t/spec/draft-ietf-jose-json-web-signature-08-A1.hmac_sha256.t
+++ b/t/spec/draft-ietf-jose-json-web-signature-08-A1.hmac_sha256.t
@@ -28,7 +28,7 @@ my $secret = pack 'C*' => @{ [
 ] };
 
 my $guard = mock_guard('JSON::WebToken' => {
-    encode_json => sub {
+    _encode_json => sub {
         my $array = [$header, $claims];
         sub { shift @$array };
     }->(),
diff --git a/t/spec/draft-ietf-jose-json-web-signature-08-A2.rsa_sha256.t b/t/spec/draft-ietf-jose-json-web-signature-08-A2.rsa_sha256.t
index f82c8ac..7b0b3f8 100644
--- a/t/spec/draft-ietf-jose-json-web-signature-08-A2.rsa_sha256.t
+++ b/t/spec/draft-ietf-jose-json-web-signature-08-A2.rsa_sha256.t
@@ -111,7 +111,7 @@ ok $rsa->verify($singing_input, $S);
 
 my $guard = mock_guard(
     'JSON::WebToken' => {
-        encode_json => sub {
+        _encode_json => sub {
             my $array = [$header, $claims];
             sub { shift @$array };
         }->(),
diff --git a/t/spec/draft-ietf-oauth-json-web-token-06-3.1.example.t b/t/spec/draft-ietf-oauth-json-web-token-06-3.1.example.t
index ddeae36..259a781 100644
--- a/t/spec/draft-ietf-oauth-json-web-token-06-3.1.example.t
+++ b/t/spec/draft-ietf-oauth-json-web-token-06-3.1.example.t
@@ -29,7 +29,7 @@ my $claims = pack 'C*' => @{ [
 my $secret = '';
 
 my $guard = mock_guard('JSON::WebToken' => {
-    encode_json => sub {
+    _encode_json => sub {
         my $array = [$header, $claims];
         sub { shift @$array };
     }->(),