Documentation
¶
Overview ¶
Package jwtalg is the canonical JWS algorithm-confusion guard shared by the OIDC/JWKS verification paths in api/oidc.go and pkg/htpx/oidc.go, which previously each carried a byte-identical private copy of the asymmetric allowlist plus the unverified-header parse (QG-060/QG-081). Sharing it here means a future allowlist change touches exactly one place and the two verifiers can never drift.
This package is import-guard neutral: it lives at the module-root internal/ (importable by both api/ — which is NOT under pkg/ — and pkg/htpx/) and depends only on the standard library, so it carries no external-dep policy.
It deliberately returns a low-level classification (alg string, malformed bool) rather than a sentinel error, so each consumer can keep its own public error contract (api.ErrUnsupportedJWTAlg / htpx.ErrUnsupportedJWTAlg, and the respective ErrMalformedAuthHeader) and wrap as it sees fit.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Classify ¶
Classify parses the unverified JOSE header of a compact JWT and returns the declared "alg" together with whether the token's header was structurally unparseable. It performs NO signature verification — it inspects only the first compact segment so a caller can reject a downgraded algorithm before any key lookup.
Contract for callers:
- malformed==true: the token has no header dot, an undecodable header segment, or non-JSON header — map to the caller's ErrMalformedAuthHeader.
- malformed==false: alg holds the declared algorithm; the caller checks IsAsymmetric(alg) and maps a false result to its ErrUnsupportedJWTAlg.
func IsAsymmetric ¶
IsAsymmetric reports whether alg is in the asymmetric allowlist.
Types ¶
This section is empty.
Source Files