@anhquoc96/fastxml-security

Portable XML security primitives for Node.js and Deno applications using fastxml.

Installation

npm install @anhquoc96/fastxml-security @anhquoc96/fastxml

Canonical XML

import { canonicalize } from "@anhquoc96/fastxml-security";

const canonicalXml = canonicalize(document);

Canonicalization produces deterministic element and attribute output suitable for digest or signing workflows. Validate the canonicalization profile required by the receiving system before relying on it for interoperability.

Web Crypto signing primitives

import { XmlSignatureService } from "@anhquoc96/fastxml-security";

const service = new XmlSignatureService();
const signature = await service.sign(document, privateKey, {
  algorithm: "RSASSA-PKCS1-v1_5",
  hash: "SHA-256",
});

const valid = await service.verify(document, publicKey, signature, {
  algorithm: "RSASSA-PKCS1-v1_5",
  hash: "SHA-256",
});

The service uses the platform Web Crypto API and also supports RSA-PSS, ECDSA, and HMAC primitives.

WS-Security UsernameToken

import { createUsernameToken } from "@anhquoc96/fastxml-security";

const token = createUsernameToken(
  "service-user",
  "secret",
  new Date().toISOString(),
);

Security boundaries

This package does not claim complete XML Signature or XML Encryption envelope serialization, certificate-chain validation, key management, replay policy, or every WS-* profile. Applications must define trust anchors, credential handling, algorithm policy, timestamp validation, and interoperability tests.

Development

npm run build --workspace @anhquoc96/fastxml-security
npm run typecheck --workspace @anhquoc96/fastxml-security

License

MIT License. See the package LICENSE file.