Documentation
¶
Overview ¶
Package jwks provides a JWKS (JSON Web Key Set) key source for validating JWTs issued by external identity providers such as Auth0, AWS Cognito, Google, or any OIDC-compliant provider.
The Source fetches public keys from a JWKS endpoint, caches them by key ID (kid), and automatically refreshes when an unknown kid is encountered — handling key rotation transparently.
Auth0 quick start ¶
import (
jwtpkg "github.com/KriaaCompany/api-security-sdk/auth/jwt"
"github.com/KriaaCompany/api-security-sdk/auth/jwks"
)
src := jwks.Auth0("myapp.auth0.com")
svc := jwtpkg.New(jwtpkg.WithJWKS(src.KeyFunc))
claims, err := svc.Verify(tokenFromAuth0)
Generic OIDC provider ¶
src := jwks.NewSource("https://accounts.google.com/.well-known/openid-configuration/jwks")
svc := jwtpkg.New(jwtpkg.WithJWKS(src.KeyFunc))
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrKIDNotFound = errors.New("jwks: no key found for kid")
ErrKIDNotFound is returned when the token's kid does not match any key in the JWKS after a fresh fetch.
var ErrUnsupportedKeyType = errors.New("jwks: unsupported key type (only RSA and EC supported)")
ErrUnsupportedKeyType is returned for JWK entries with an unsupported kty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Source)
Option configures a Source.
func WithCacheTTL ¶
WithCacheTTL sets how long fetched keys are cached before the next background refresh. Default: 15 minutes.
func WithHTTPClient ¶
WithHTTPClient replaces the default HTTP client used to fetch the JWKS. Use this to set custom timeouts, TLS config, or a proxy.
func WithMinRefreshDelay ¶
WithMinRefreshDelay sets the minimum time between forced key-rotation refreshes (triggered by an unknown kid). Default: 30 seconds.
type Source ¶
type Source struct {
// contains filtered or unexported fields
}
Source fetches and caches public keys from a JWKS endpoint.
func Auth0 ¶
Auth0 creates a Source for an Auth0 tenant.
src := jwks.Auth0("myapp.auth0.com")
The domain may optionally include the "https://" scheme prefix; it is normalised automatically.
func NewSource ¶
NewSource creates a Source that fetches keys from the given JWKS URL. Keys are fetched lazily on the first call to KeyFunc.
Source Files