Documentation
¶
Overview ¶
Package auth0 provides a verifier for Auth0 Management API tokens. It uses the Auth0 Management API GET /api/v2/ endpoint with Bearer auth to check token validity. The Auth0 Management API is tenant-scoped, so the target host is derived from the token's own iss claim rather than a fixed host.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether an Auth0 Management API token is active by calling the Auth0 Management API. It NEVER logs or persists raw token values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected Auth0 Management API token is valid/active.
An Auth0 Management API token is a JWT that is only valid against its own tenant's domain. The tenant host is taken from the token's iss claim (when apiURL is not overridden for testing). A non-JWT input, or a JWT without an iss claim, is indeterminate: the token cannot be routed to a tenant, so the result is StatusUnverified rather than a false "invalid".
Source Files